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5. (U) Assessments 


5.1. (U) Overview 

(U//FOUO) The Attorney General’s Guidelines for Domestic FBI Operations (AGG-Dom) 
combine “threat assessments” under the former Attorney General’s Guidelines for FBI National 
Security Investigations and Foreign Intelligence Collection and the “prompt and extremely 
limited checking out of initial leads” under the former Attorney General’s Guidelines on General 


Crimes, Racketeering Enterprise and Terrorism Enterprise Investigations into a new 
investigative category entitled “assessments.” All ass essments must eithe r be opened in an 
investigative cla ssifi cation as an assessment file (e.g.J I). placed in al 



l(e.g., 

), or placed 

m arj 

as discussed in greater detail below. 



(U//FOUO) Note: In the DIOG, the word “assessment” has two distinct meanings. The AGG- 
Dom authorizes as an investigative activity an “assessment” which requires an authorized 
purpose as discussed in this section of the DIOG. The USIC, however, also uses the word 
“assessment” to describe written intelligence products, as discussed in DIOG Section 15.7.B . 

(U) Assessments authorized under the AGG-Dom do not require a particular factual predication 
but do require an authorized purpose. Assessments may be carried out to detect, obtain 
information about, or prevent or protect against federal crimes or threats to the national security 
or to collect foreign intelligence. (AGG-Dom, Part II and Part II. A) 

(U//FOUO) Although “no particular factual predication” is required, the basis of an assessment 
cannot be arbitrary or groundless speculation, nor can an assessment be based solely on the 
exercise of First Amendment protected activities or on the race, ethnicity, national origin or 
religion of the subject. Although difficult to define, “no particular factual predication” is less 
than “information or allegation” as required for the initiation of a preliminary investigation. For 
example, an assessment may be conducted when there is a basis to know: (i) whether more 
information or facts are required to determine if there is a criminal or national security threat; 
and (ii) there is a rational and articulable relationship between the stated authorized purpose of 
the assessment on the one hand and the information sought and the proposed means to obtain that 
information on the other. Regardless of whether specific approval or specific documentation is 
required, an FBI employee should be able to explain the purpose of an assessment and the reason 
for the methods used to conduct the assessment. Those FBI employees who conduct assessments 
are responsible for assuring that assessments are not pursued for frivolous or improper purposes 
and are not based solely on First Amendment activity or on the race, ethnicity,, national origin, or 
religion of the subject of the assessment. (AGG-Dom, Part II) 

(U//FOUO) An FBI employee can search historical information already contained within: (i) FBI 
data systems; (ii) United S tates Intelligence Community fUSICD systems to which an FBI 
employee has access fe.g.J ] 

. I); (iii) any other United States Government database to 

which an FBI employee has access; and (iv) the FBI employee can also conduct open-source 
Internet searches without initiating an assessment (open-source Internet searches do not include 
any paid-for-service databases such as Lexis-Nexis and Choicepoint), as further discussed in 
Section 5.6.A.1 and Section 15. The use of such paid-for-service databases requires the initiation 
of an assessment or predicated investigation. This allows the FBI employee to possibly resolve a 
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matter without the need to conduct new investigative activity and open an assessment. 
Additionally, through analysis of existing information, the FBI employee may produce products 
that include, but are not limited to an Intelligence Assessment, Intelligence Bulletin and 

J If, while conducting analysis, the FBI employee finds a gap 


i— # u j — * — v J ■****“ - O r 

in intelligence that is relevant to an authorized FBI activity, the FBI employee can identify the 
gap for p ossible d evelopment of a “collection requirement.” The applicable | | 

(or other | l as directed in the DI PG) must be used to 


document this analysis. See the Directorate of Intelligence fPIt PG for file classification 
guidance. 


5.2. (U) Purpose and Scope 

(U//FOUO) The FBI cannot be content to wait for leads to come in through the actions of others; 
rather, we must be vigilant in detecting criminal or national security threats to the full extent 
permitted by law, with an eye towards early intervention and prevention of criminal or national 
security incidents before they occur. For example, to carry out its central mission of protecting 
the national security, the FBI must proactively collect information from available sources in 
order to identify threats and activities and to inform appropriate intelligence analysis. Collection 
required to inform such analysis will appear as FBI National Collection Requirements and FBI 
Fjgl d Office Collection Requirements . Likewise, in the exercise of its protective functions, the 
FBI is not constrained to wait until information is received indicating that a particular event, 
activity or facility has drawn the attention of would-be perpetrators of terrorism. The proactive 
authority conveyed to the FBI is designed for, and may be used by, the FBI in the discharge of 
these responsibilities. The FBI may also conduct assessments as part of its special events 
management responsibilities. (AGG-Dom, Part II) 

(U) More broadly, detecting and interrupting criminal activities at their early stages, and 
preventing crimes from occurring in the first place, is preferable to allowing criminal plots to 
come to fruition. Hence, assessments may also be undertaken proactively with such objectives as 
detecting criminal activities; obtaining information on individuals, groups, or organizations of 
possible investigative interest, either because they may be involved in criminal or national 
security-threatening activities or because they may be targeted for attack or victimization in such 
activities; and identifying and assessing individuals who may have value as confidential human 
sources. (AGG-Dom, Part II). 

(U//FOUO) As described in the below-scenarios, assessments may be used when an “allegation 
or information or an articulable factual basis” (the predicates for predicated investigations) 
concerning crimes or threats to the national security is obtained and the matter can be checked 
out or resolved through the relatively non-intrusive methods authorized in assessments (use of 
least intrusive means). The checking of investigative leads in this manner can avoid .the need to 
proceed to more formal levels of investigative activity (predicated investigation), if the results of 
an assessment indicate that further investigation is not warranted. (AGG-Dom, Part II) 
Hypothetical fact patterns are discussed below: 

A. (U//FOUO)| I 
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(U//FOUOl| If 


(U//FOUOf 


H (U//FOUOj I 


(U//FOUO; 


LUi/FOUPA 


I. (U//FOUO)| 1 | 

^(U//FOUOj 3 ^ | 

(U//FQUQj ~~| 


5.3. (U) Civil Liberties and Privacy 
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(U) The pursuit of legitimate goals without infringing upon the exercise of constitutional 
freedoms is a challenge that the FBI meets through the application of sound judgment and 
discretion. In order to ensure that civil liberties are not undermined by the conduct of 
assessments, every assessment under this subsection must have an authorized purpose and an 
identified objective. The purpose and objective of the assessment must be documented and 
retained as described in this section and in DIOG Section 14 . 


(U) Even when an authorized purpose is present, an assessment could create the appearance that 
it is directed at or activated by constitutionally protected activity, race, ethnicity, national origin 
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or religion — particularly under circumstances where the link to an authorized FBI mission is not 
readily apparent. In these situations, it is vitally important that the authorized purpose and the 
underlying reasons for conducting the assessment and engaging in the proposed methods are well 
documented. 

(U) No investigative activity, including assessments, may be taken solely on the basis of 
activities that are protected by the First Amendment or on the race, ethnicity, national origin or 
religion of the subject. If an assessment touches on or is partially motivated by First Amendment 
activities, race, ethnicity, national origin or religion, it is particularly important to identify and 
document the basis for the assessment with clarity. 

(U//FOUO) Example: Individuals or groups who communicate with each 
other or with members of the public in any form in pursuit of social or 
political causes — such as opposing war or foreign policy, protesting 
government actions, promoting certain religious beliefs, championing 
particular local, national, or international causes, or a change in government 
through non-criminal means, and actively recruit others to join their causes — 
have a fundamental constitutional right to do so. An assessment may not be 
initiated based solely on the exercise of these First Amendment rights. If, 
however, a group exercising its First Amendment rights also threatens or 
advocates violence or destruction of property, an assessment would be 
appropriate. 

(U) The AGG-Dom require that the "least intrusive" means or method be considered and — if 
operationally sound and effective — used in lieu of more intrusive methods to obtain intelligence 
and/or evidence. This principle is also reflected in Executive Order 12333. which governs the 
activities of the USIC. Executive Order 12333 lays out the goals, directions, duties and 
responsibilities of the USIC. The concept of least intrusive means applies to the collection of all 
intelligence and evidence, not just that collected by those aspects of the FBI that are part of the 
intelligence community. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence and/or evidence, 
FBI employees can effectively execute their duties while mitigating the potential negative impact 
on the privacy and civil liberties and the damage to the reputation of all people encompassed 
within the investigation or assessment, including targets, witnesses, and victims. This principle is 
not intended to discourage FBI employees from seeking relevant and necessary intelligence, 
information, or evidence, but rather is intended to encourage FBI employees to choose the least 
intrusive — but still effective — means from the available options to obtain the information. 
(AGG-Dom, Part I.C.2) 

5.4. (U) Authorized Purposes (AGG-Dom, Part II.A.2. — Authorized Activities) 

A. (U) Assessment Activities: During an assessment, the FBI may: 

1 . (U) Seek information, proactively or in response to investigative leads, relating to 
activities constituting violations of federal criminal law or threats to the national security; 

2. (U) Seek information, proactively or in response to investigative leads, relating to the 
involvement or role of individuals, groups, or organizations relating to activities 
constituting violations of federal criminal law or threats to the national security; 
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3 (in Identify and obtain information about potential targets of or vulnerabilities to 
crimSivities in violation of federal law or threats to the national security; 

4. (U) Obtain information to inform or facilitate intelligence analysis and planning (AGG- 
Dom, Part IV); 

« n n Seek information to identify potential human sources, assess the suitability, 

of individuals as human sources, validate human sources or maintain 
the cover or credibility of human sources, who may be able to provideorobtam 
information relating to criminal activities in violation of federal law, threats to the 
national security, or matters of foreign intelligence interest; and 

6. (U) Seek information, proactively or in response to investigative leads, relating to matters 
of foreign intelligence interest responsive to foreign intelligence requirements. 

5.5. (U//FOUO) Standards for Initiating or Approving an Assessment 

(U//FOUO) Before initiating or approving an assessment, an FBI employee or approving official 
must determine whether: 

A. (U//FOUO) An authorized purpose and objective exists for the conduct of the assessment, 

B. (U//FOUO) The assessment is based on factors other than the exercise of First Amendment 

activities or the race, ethnicity, national origin or religion of the subject; and 

C. (U//FOUO) The assessment is an appropriate use of personnel and financial resources. 

5.6. (U) Duration, Approval, Notice, Documentation, File Review and Responsible 
Entity 

(U//FOUO) FBIHQ and FBI Field Offices have the authority to conduct all assessment activities 
as authorized in Section 5.4. Field Office personnel and approving officials, as S P^ C “ 

DIOG Section 5.6.A.1-6, equate to the following FB1HQ personnel and approving off 
FBIHQ initiates, conducts, or closes an assessment: 

• (U//FOUO) Field Office Analyst or Special Agent (SA) = FBIHQ Analyst, SA, or 
Supervisory Special Agent (SSA); 

• (U//FOUO) Field Office Supervisory Intelligence Analysts (SIA) = FBIHQ SIA; 

. (U//FOUO) Chief Division Counsel (CDC) = FBIHQ Office of the General Counsel 
(OGC); 

• (U//FOUO) Field Office SSA = FBIHQ Unit Chief (UC); and 

• (U//FOUO). Special Agent in Charge (SAC) = FBIHQ Section Chief (SC). 

A. (U//FOUO) Duration, Approval, Notice, Documentation, File Review and Responsible 
Entity: An FBI employee must document on the FD^Zi or m Guard ian the use of or the 
request and approval for the use of authorized investigative methods in type 1 and 2 
assessments (see DIOG Section 5.6.A.1 and 2, below). By exception, certain > assessment Type 
1 and 2 situations may require the use of an electronic communication (EC) to document he 
use and approval of particular investigative methods. All type 3, 4, and 6 (see DIOG Sect 

5.6.A.3.4. and 6, below) assessments and authorized investigative methods requiring 
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supervisory approval must use an EC to document the approval of the assessment and the 
request and approval for the use of an applicable investigative method. 

(U//FOUO.) For type 5 assessment activities, an FBI employee must follow the duration, 
approval, and other requirements specified in the FBI’s Confidential Human Source Policy 
Manual (CHSPM), Confidential Human Source Validation Standards Manual (CHSVSM), 
and The Attorney General 's Guidelines Revardinv the Use of FBI Confidential Human 
Sources (AGG-CHS), as implem ented ini All type 5 assessment activities under this 

provision must be documented in i i unless otherwise directed in the DI PG or other 

FBIHQ Division PGs. If there is any inconsistency between the CHSPM or CHSVSM and 
the DIOG, the DIOG controls and OGC should be immediately notified of the conflict.. 

(U//FOUO) Listed below are the applicable duration, documentation, justification/file review, 
approval level, and responsible entity for each type of assessment, described in DIOG 
Section 5.4 above. 


1. (U//FOUO) Seek information, proactively or in response to investigative leads, 
relating to activities constituting violations of federal criminal law or threats to the 
national security (e.g., the prompt checking of leads on individuals or activity). 


(U//FOUO) Duration: There is no time requirement for this type of assessment, but it is 
anticipated that such assessments will be relatively short. These assessments require 
recurring 30-day justification reviews by the SSA or SIA as discussed below. 

(U//FOUO) Documentation: Guardian will be used for| ~| 


The electronic FD-7 Las discussed below, must b e used to 


Guardian £ 


JFD-71 


or 


(U//FOUO) Approval: An FBI employe e may initiate an assessment under this 


subsection without supervisory approval.! 



Ian FD-7I or Guardian 


1 


FD-71 


or Guardian. The initiation date for this type of assessment is the date the SSA or SIA 
assigns an FBI employee to conduct the assessment. 


(U//FOUO) As soon as practicable following the determination that this type of 
assessment involves a sensitive investigative matter, the matter must be brought to the 
CDC for review and to the SAC for approval to continue the assessmen t. The ter m 
“sensitive investigative matter” is defined in Section 5.7 and Se ction lOl I 
~| the FD-7 1 or Guardian 1 "Hi 

[ Higher supervisory approval, as described in Section 5.9 . may be required 
before using one or more of the following investigative methods: physical surveillance, 
certain interviews, and tasking of confidential human sources. In addition, as specified in 
the Division policy implementation guides (PG), there are agreements (e.g.. Memoranda 
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of Agreements/Understanding, Treaties) that may require particular coordination prior to 
the release/acquisition of federal, state, local, tribal, and foreign government information. 

(U//FOUO) Justification Review: If this type of assessment is not concluded within 30 
days, the SSA or SI A must conduct recurring 30-day justification reviews in accordance 
with Section 3.4 . This justification review must: 

a. (U//FOUO) Evaluate the progress made toward achieving the authorized purpose and 
objective; 

b. (U//FOUO) Ensure activities that occurred during the prior 30 days were appropriate; 

c. (U//FOUO) Determine whether it is reasonably likely that information will be. 
obtained that is relevant to the authorized objective, thereby warranting an extension 


for another 30-days; 

d. (U//FOUO) Determine whether adequate predication has been developed to justify 
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass 
destruction predicated investigation; and 


e. 


(U//FOUO) Determine whether the assessment should be terminated. 
('U//FOUO) The FBI employee must ensure that[~ 


In the FD-71 or Guardian. The completed FD-71 or 

■J _ - • < 1 rr-»1 T-»T-v /“T 1 . 


3 


iuardian 

requires supervisory approval before being uploaded. The FD-71 or Guardian must also 
document supervisory approval for the use of any investigative method that requires 
approval, such as: physical surveillance; certain interviews; or tasking of confidential 
human sources (see DIOG Section 5.9) . In addition, as specified in the Division PG, there 
are agreements (e.g., Memoranda of Agreements/Understanding, Treaties) that may 
require particular coordination prior to the release/acquisition of federal, state, local, 
trihgl anH fnrsipn government information.! 1 


classification as described in Section 5.14. 


within the appropriate 


(U//FOUO) Responsible Entity: This type of assessment is conducted by the appropriate 
substantive Field Office Squad. 

,nT//FOPO)[ 
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access, he/she can also review already existing data contained in my United State s 

Government data system and search open source information on the Internet^ 1 

1 Open-source Internet searches do not include any paid-tor- 

service databases such as Lexis- N exis and ChoicepointL 


] 


( 


database checks or open source Internet searches do not reveal any derogatory 
information, the FBI employee may terminate this activity without opening an assessmen 

or documenting these activities on a n FD-71. 

(U//FOUO)! 


/ 





IU//rUUUj seen raiorniauoii, «« — -—r ° . 

relating to the involvement or role of individuals, groups, or organizations in 
activities constituting violations of federal criminal law or threats to the national 
security (e.g., the prompt checking of leads on groups or organizations). 


(U//FOUO) Duration: There is no time requirement for this type of assessment, but it is 
anticipated that such assessments will be relatively short. These assessments require 
recurring 30-day justification reviews by the SSA or SIA as discussed below. 

a T//FOT IQt Documentation: Guardian | I 


iThe electronic FD-71, 1 f 


n —r- 



]FD-7 1 or 


finardiarl 1 

/n//Ennn\ Annmval- An FRT emnlovee mav initiate an assessment under this 


subsection without supervisory approval 



r i r 


- | the FD-71 

or Guardian. The initiation date for this type of assessment is the date the SSA or SIA 
assigns an FBI employee to conduct the assessment 


(U//FOUO) As soon as practicable following the determination that this type of 
assessment involves a sensitive investigative matter, the matter must be brought to the 
CDC for review and to the SAC for approval to continue the assessment. The term 
“sensitive investigative matter” is defined in Section 5.7 and Section 10 . When 
completing the FD-71 or Guardian lead for an assessment involving a sensitive 
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| Higher supervisory approval, as described in Section , ^ may be required before 
using one or more of the following investigative methods: physical surveillance, certain 
interviews, and tasking of confidential human sources. In addition, as specified m the 
Division PGs, there are agreements (e.g., Memoranda of Agreements/Understanding, 
Treaties) that may require particular coordination prior to the release/acquisition ot 
federal, state, local, tribal and foreign government information. 

(U//FOUO) Justification Review: If this type of assessment is not concluded within 30 
days, the SSA or SIA must conduct recurring 30-day justification reviews m accordance 
with Section 3.4 . This justification review must: 

a. (U//FOUO) Evaluate the progress made toward achieving the authorized purpose and 
objective; 

b. (U//FOUO) Ensure activities that occurred during the prior 30 days were appropriate, 

c. (U//FOUO) Determine whether it is reasonably likely that information will be 
obtained that is relevant to the authorized objective, thereby warranting an extension 
for another 30-days; 

d. (U//FOUO) Determine whether adequate predication has been developed to justify 
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass 
destruction predicated investigation; and 


e. 


(U//FOUO) Determine whether the assessment should be terminated. 


('U//FOUO') The FBI employee must ensure that! J ,. 

\ in the FD-71 or Guardian. The completed FD-71 or Guardian 

requires supervisory approval before being uploaded. The FD-71 or Guardian must also 
document supervisory approval for the use of any investigative method that requires 
approval, such as: physical surveillance; certain interviews; or tasking of confidential 
human sources (see Section 5.9) . In addition, as specified in the Division PGs, there are 
agreements (e.g.. Memoranda of Agreements/Understanding, Treaties) that may require 
particular coordination prior to t he release/acquisition of federal, s tate, local, tribal and _ 
foreign government information.] ■ 


(U//FOUO) Responsible Entity: This type of assessment is conducted by the appropriate 
substantive Field Office Squad. 
m/reoTT(yj 



b2 

b7E 


b2 

b7E 


b2 

b7E 


49 

UNCLASSIFIED-FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 


UT//FOITO 


flTZ/FOTIO' 


■ 1 
3. (U) Identify and obtain information about potential targets of or vulnerabilities to 
criminal activities in violation of federal law or threats to the national security. 

(U//FOUO) Assessments in this section may include activities designed to collect 
information for domain analysis that is focused on identifying targets of or vulnerabilities 
to criminal conduct or threats to the national security. FBIHQ directed National Domain 
Assessments must be coordinated in advance with the FBIHQ DI, Domain Management 
Section (DMS). See the Dl PG for details. 

(U//FOUO) This type of assessment may not be used for the purpose of collecting 
positive foreign intelligence, although such intelligence may be incidentally collected 
during this type of assessment. Positive foreign intelligence can only be collected 
pursuant to Section 5.6.A.6 and Section 9 . 

(U//FOUO) Duration: An FBI employee may initiate an assessment for this purpose only 
with prior SSA or SIA approval. The effective date of the assessment is the date the 
supervisor approves the EC. Such an assessment may continue for as long as necessary to 
achieve its purpose and objective. When the objective has been met, a closing EC must 
be approved by the SSA or SIA and uploaded to the file. 

(U//FOUO) Documentation: The approval to initiate this type of assessment and the 
r t fnr tmnmval to me applicable investigative methods must be documented m an 


rcqi| 

EC. 


1 


(U//FOUO) Approval: All assessments conducted pursuant to this subsection mustbe 

' - . > nt i .11 J aUL/vk onnrnnrmtpl 


yKJli J. vvvy i xx » — * . ■ *1 

approved in advance by an SSA or SIA and be opened in either the appropriate! 1 

~ |( or other| : |as directed in the DI PG) or the 

appropriate substantive investigative classification as an assessment file with an opening 
' EC. The title/case caption of the opening EC must contain the word “Assessment,” and 
the synopsis must identify the purpose and the objective of the assessment. If at the time 
of the opening, or at anytime thereafter, the assessment involves a sensitive investigative 
matter, the title/case caption must contain the words “Assessment and Sensitive 
Investigative Matter.” 

(U//FOUO) File Review: This type of assessment requires recurring 90-day file reviews 
of the assessment file and any sub-file by the SSA or SIA in accordance with Section 3.4. 
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Investigative file reviews for probationary FBI employees are recommended every 30 
days but must be conducted at least every 60 days. This file review must: 

3 objecf Evaluate the progress made towa rd achieving the authorized purpose and 


c. 


d. 


b. (U//FOUO) Determine whether it is reasonably likely that information will be 
obtained that is relevant to the authorized objective, thereby warranting an extension 
tor another 90 days (at least every 60 days for probationary FBI employees); 

(U//FOUO) Determine whether adequate predication has been developed to justify 
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass 
destruction predicated investigation; and 

(U//FOUO) Determine whether the assessment should be terminated. 

(U//FOUO) An SSA or SIA may approve an assessment under this subsection in 
accordance with the standards listed in the DIOG Section 5.5. However, if the assessment 
m ^°* V A e ® a sensit ive investigative matter, then the initiation requires prior CDC review 
and SAC approval. If a sensitive investigative matter arises after the initiation of an 
assessment, investigative activity must cease until CDC review and SAC approval is 

ThC term “ sensitive investigative matter” is defined in Section 5.7 and Section 
M- H!gher supervisory approval, as described in Section 5.9. may be required prior to use 
ot the following investigative methods: physical surveillance, certain interviews, and 
tasking ot confidential human sources. In addition, as specified in the Division PGs there 
are agreements (e.g., Memoranda of Agreements/Understanding, Treaties) that may 
require particular coordination prior to the release/acquisition of federal, state, local 
tribal and foreign government information. 

(U//F0LJ 0 ) Any collection undertaken in order to identity threats, vulnerabilities, or 
m e lgence gaps identified as a result of domain analysis or in response to an FBI 
National Collection Requirement or FBI Field Office Collection Requirement must be 
addressed in a separate subs.tantivg.cJaasi.ficatinn.a.ssp.s-imeni-rd^pcording to the 
investigative matter (e.g, Additionally, any 

time an assessment begink iu iucus on a particular individual, a separate substantive 
classification assessment file or subfile, as appropriate, according to the investigative 
matter must be opened on the individual. 

S™^ ) R n Sp0nsibIe Entity: In generaI ’ the Field Intelligence Group (FIG) or 


IJ RAM. VJUiCl I loo 

directed m the DI ruj or a substantive investigative classification file. This includes 

snhstflntivp !ICCA A — : 1 r 1 , ... UV1UUVJ 


' viftMiutauun me. inis 1 

(or Other f 6 aSSSSSm?ntR derived from ^ analysis produced and documented iif 


f t . pt j , , l as directed in the DI PG). Under the management 

th i fit FI f suostantlv e to e, d Office Squads can support the collection of information for 
this type of assessment. However, substantive Field Office Squads or FBIHQ Units will 

^: P ° nS : b!e .[r, ln " ating and managing P art i c nlar kinds of type 3 assessments. These 
^^sessments will be documented in the appropriate substantive investigative classification 
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4. (U//FOUO) Obtain information to inform or facilitate intelligence analysis and 
planning. fAGG-Dom. Part IVj 


(U//FOUO) Assessments in this section may include activities designed to collect 
information for domain analysis in order to respond to an FBI National Collection 
Requirement or FBI Field Office Collection Requirement created in response to FBI 
operational needs or an intelligence gap identified through strategic analysis that was 
conducted as part of the FBI’s national security or law enforcement responsibilities, as 
discussed in Sections 5. 1 l and 5J2. FBIHQ directed National Domain Assessments must 
be coordinated in advance with the FBIHQ DI, Domain Management Section (DMS) See 
the DI PG for details. 

(U//FOUO) This type of assessment may not be used for the purpose of collecting 
positive foreign intelligence, although such intelligence may be incidentally collected 
during this type of assessment. Positive foreign intelligence can only be collected 
pursuant to Section 5.6.A.6 and Section 9 


(U//F°U°) Duration: An FBI employee may initiate an assessment for this purpose only 
with prior SSA or SI A approval. The effective date of the assessment is the date the 
supervisor approves the EC. Such an assessment may continue for as long as necessary to 
achieve its purpose and objective. When the objective has been met, a closing EC must 
be approved by the SSA or SIA and uploaded to the file. 


(U//FOUO) Documentation: The approval to initiate this type of assessment and the 
£S u “ tfor a PP rov aI to use applicable investigative methods must be docu mented in an 
EC. This type of a ssessme nt may be documented in eith er the appropriate ! 

I Kor other | | as directed in the DI PG) or the 


- ■ v*iJ .vviyu 

appropriate substantive investigative classification assessment file 
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(U//FOUO) Approval: All assessments conducted pursuant to this subsection must be 
approved in advan ce by anSSAoiSIA and be nneneri in either the appropriate \~~ 
_J(or other) las Hirpr-tpH in the. riT prrH" 



c. 


(U//FOUO) Fde Review: This type of assessment requires recurring 90-day file reviews 
of the assessment file and any sub-file by the SSA or SIA in accordance with DIOG 
^ectmM. Investigative file reviews for probationary FBI employees are recommended 
every 30 days but must be conducted at least every 60 days. This file review must: 

a ' o^ecfive°^ EValUate the progress made toward achieving the authorized purpose and 

b. (U//FOUO) Determine whether it is reasonably likely that information will be 
obtained that is relevant to the authorized objective, thereby warranting an extension 
for another 90 days (at least every 60 days for probationary FBI employees); 

(U//FOUO) Determine whether adequate predication has been developed to justify 
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass 
destruction predicated investigation; and 

d. (U//FOUO) Determine whether the assessment should be terminated. 

(U//FOUO) An SSA or SIA may approve an assessment under this subsection in 

fnvnlv ^ Wldl the standards listed in the DIOG Se ction 5.5 . However, if the assessment 
involves a sensitive investigative matter, then the initiation requires prior CDC review 
and SAC approval. If a sensitive investigative matter arises after the initiation of an 
assessment, investigative activity must cease until CDC review and SAC approval is 
acquired. The term “sensitive investigative matter” is defined in Section 5.7 and DIOG 
ghonjfl. Higher supervisory approval, as described in Section 5.9, may be reqd^ 
before using the following investigative methods: physical surveillance, certain 

Di!kion W pr an l ta n8 of confidentiai human sources. In addition, as specified in the 
TrJtS * thCre are agreements Memoranda of Agreements/Understanding, 

lT r !f * rVT 1 ? pai1lCular coordina tion prior to the release/acquisition of 
eral, state, local, tribal and foreign government information. 

Any c ° 1Iecdo ” under taken in order to identify threats, vulnerabilities, or 
M . g . n ?, e gaps ldentl fied as a result of domain analysis or in response to an FBI 
Jtooml Collection Requirement or FBI Field Office Collection Requirement must be 
addressed in a separate substantive classification as sessment flu un cording to the 
investigative matter (e.g.,1 I " ° u 


5“ J? a ® sessment begins^to locus on a particular individual, a sepamt^substanfiv^ 

mattefrn, Th aSSeSSm ? nt ^ ° r Subfile> 38 a PP ropriate > according to the investigative 
matter must be opened on the individual. s 
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(U//FOUO) Responsible Entity: The FIG or FBIHQ DI will manage this type of 
assessment, regardless of whether the assessment is documented in an l I tor 

°^ er l l as directed in the DI PG) or a substantive investigative 

classification file. This includes s ubstantiv e assessments derived from an alysis produced 

1 (0r othe c l I as directed in the 

DI PG). Under the management of the FIG, substantive Field Office Squads can support 
the collection of information in this type of assessment. 

(U//FOUO) I T I 


(U//FOUO 




(U//FOUO) Seek information to identify potential human sources, assess the 
suitability, credibility, or value of particular individuals as human sources, validate 
human sources, or maintain the cover or credibility of human sources, who may be 
able to provide or obtain information relating to criminal activities in violation of 
haterest aW? thrCatS t0 the nationaI security, or matters of foreign intelligence 

(U//FOUO) Duration: All such activities must follow the policy requirements 
established in the FBI’s Confidenti al Human Source Policy Manual (CHSPM), 
Co nfidential Human Source Validation Standards Manual (CHSVSM), and The Attorney 
Cmteral s Guidelines Reeardim* the Use of FBI Co n fidential Human Soutc^ TaGG- 
), and implemented in| If there is any inconsistency between the CHSPM or 
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the conmlt and ^ DI ° G ’ ^ DI ° G COntrols and 0GC should be immediately notified of 


(U//FOUO) Documentation: | |must be used to document all activities under this 

provision, unless otherwise directed in the D1 PG or other FBIHQ Division PGs. 

f I U/ ?£ U °2A p P r0Va,: AH a PProvals must follow the policy requirements established in 
the FBI s CHSPM, CHSVSM, and the AGG-CHS, and as implemented in i [ 


CHSPM F,1C ReVICW: File reviews must be conducted in accordance with the FBI’s 

(U // F°U°) Responsible Entity: A FIG or substantive squad may conduct and manage 
this type of assessment. 

(U//FOUO) Seek information, proactively or in response to investigative leads, 

re atmg to matters of foreign intelligence interest responsive to foreign intelligence 
requirements. 6 

(U//F0 U °) Foreign Intelligence is “information relating to the capabilities, intentions, or 
activities of foreign governments or elements thereof,' foreign organizations, or foreign 
persons or international terrorists.” The FBI defines a foreign intelligence requirement to 
be a collection requirement issued by the United States Intelligence Community (USIC) 
and accepted by the FBI DI. The collection of foreign intelligence pursuant to this 
cr ^ 1 °" e ^ ends the sphere of the FBI’s information-gathering activities beyond federal 
crimes and threats to the national security, and permits the FBI to seek information 

2S 8 , a br ° ader ran 8 e f matters relating to foreign powers, organizations, or persons 

toduction' A3) t0 C UCt ° f thC Unit6d Stat£S ’ f ° reign affairs - ( AGG - Dom > 

(U//FOUO) Under this authorized purpose, an FBI employee may only collect 
information that relates to matters of positive foreign intelligence. (See DIOG Section 9 
for a description of “positive foreign intelligence.”) An FBI employee should prioritize 
collection against FBI National Collection Requirements before attempting to collect 

2 a P° sm y e f o rei g n intelligence requirement. The DI PG furnishes guidance on the 
prioritization of collection. 

2S D Sl° n: cca FBI empIoyee may initiate an assessment for this purpose only 

^MSI ^anoroval ^ Ce * V a FBIHQ Collection Management Section 

( MS) approval The effective date of the assessment is the date FBIHQ CMS approves 

the assessment Such an assessment may continue for as long as necessary to achieve its 

bXeFil STS Wh X he ? je0tive has bee ” ”«■ a EC b «PP-ved 

by the Field Office SSA or SIA and FBIHQ CMS and uploaded to the file. 

(U//FOUO) Documentation: This type of assessment must use an EC to document the 
initiation approval of the assessment and the request and approval for the use of 
app hcabb investigative methods. Fo reign intelligence collected pursuant tn this 


or as otherwise 


subsection must be maintained in thel 

determined by FBIHQ CMS. The Djfc»er describes this process. 

interest^m ii A ? prova 1 ' Assessments to collect on matters of “foreign intelligence 
interest must be approved in advance by FBIHQ CMS in accordance with the standards 
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listed in Section 5.5 



l_ Jin addition to the normal 

requirement to use the least intrusive method to gather information during an assessment 
when conducting this type of assessment the FBI employee must be mindful of the 

additional requirement to operate openly and consensually with a United States.person to 
the extent practicable. 5 

(U//FOUO) File Review: This type of assessment requires recurring 90-day file reviews ' 
of the assessment file and any sub-file by the SSA or SIA in accordance with Section 3 4 
investigative file reviews for probationary FBI employees are recommended every 30 
days but must be conducted at least every 60 days. This file review must: 

3 ob^eedve 0 ’* EValU3te the progress made toward achieving the authorized purpose and 

b. (U//FOUO) Determine whether it is reasonably likely that information will be 
obtained that is relevant to the authorized objective, thereby warranting an extension 
tor another 90 days (at least every 60 days for probationary FBI employees); 

c. (U//FOUO) Determine whether adequate predication has been developed to justify 
opening a criminal, counterterrorism, counterintelligence, cyber, or weapons of mass 
destruction predicated investigation; and 

d. (U//FOUO) Determine whether the assessment should be terminated. 

(U//FOUO) If the initiation of the assessment involves a sensitive investigative matter it 
must be reviewed by the CDC and approved by the SAC, prior to seeking FBIHQ CMS 

inve«S- 0n ‘ IaSCnSltlVe mVCSt,gative matter arises after th e initiation of an assessment, 
investigative activity must cease until CDC review and SAC approval is acquired and 

no ice provided to FBIHQ CMS. Higher supervisory approval, as described in Section 

— , be required before usin g the following investigative methods: physical 

^™r!i e ’- C !u a ^ interVieWS ’ 3nd tasking °f confidential human sources. In addition 
s specified in the Division PGs, there are agreements (e.g.. Memoranda of 

reST 1 / ' 2ntS ' ! U " derst f ldmg > Treaties) that may require particular coordination prior to the 

tofomatbn U1SItl ° n ° f C6rtam federal > state > locaI > tribal and foreign government 

^ / jntdned\ P | )SitiVe f ° reign mtelli ^ , g , S - Co l,l ect e d . nuj- suant to this subsection must be 


maintained ini i ^ , 

FRrwn = l° r as otherwise determined by 

FBIHQ CMS., l he title/case caption of the opening EC must contain the word 

Assessment and the synopsis must identify the purpose and the objective of the 
assessment. If at the time of the opening, or at anytime thereafter, the assessment 

^rerr e 4 nv ^ gai r matter - the twe/case capti ° n mus * c ° n,ain * he 

Assessment and Sensitive Investigative Matter.” The PI PG further describes this 
process. 
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(U//FOUO) Responsible Entity: This type of assessment is managed by the FIG and 
FBIHQ DI. 

5.7. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment 

A. (U//FOUO) Sensitive Investigative Matter: An investigative matter involving the activities 
ot a domestic public official or political candidate (involving corruption or a threat to the 
national security), religious or political organization or individual prominent in such an 
organization, or news media, or any other matter which, in the judgment of the official 
au^onzmg an investigation, should be brought to the attention of FBI Headquarters and 
t °* e t r , D ° J officia *s- (AGG-Dom, Part VII.N.) As a matter of FBI policy, “judgment” means 
that the decision of the authorizing official is discretionary. DIOG Section 1 0 and the Dior,' 
classified Appendix G define! 


B. (U//FOUO) Academic Nexus:l~ 


(U//FOUO) The sensitivity related to an academic institution arises from the American 
tradition of ‘academic freedom” (e.g., an atmosphere in which students and faculty are free 
to express unorthodox ideas and views and to challenge conventional thought without fear of 
repercussion). Academic freedom does not mean, however, that academic institutions are off 

limits to FBI investigators in pursuit of information or individuals of legitimate investigative 
interests 


(U//FOUO) ' 


I see the i)IUG classified Appendix G~ 


] 


(U//FOUO) Buckley Amendment: A request for “academic records” must only be made 
pursuant to the provisions of the Buckley Amendment (The Family Educational Rights and 

PATSvrA^m 7 !’ 20 U ' S ' C ' § 1232 t §3 ’ as amended b y Public Law 107-56 [“USA 
miKiui Act ]). An FBI employee is prohibited from receiving “academic records” that 
have not been properly requested pursuant to the Buckley Amendment. The definition of 
academic records is very broad and covers almost all records about a student other than 
p blic student directory-type information published by the institution. The Buckley 

Amendment contains a penalty provision for those mcti'tut; An O tKot imnvnMAj.. * _ 

academic records i 


-r r kjj u*v U19UIUUU11. me du(/M6Y 

Amendment contains a penalty provision for t hose institutions that improperly nrnv.de 
:ords to law enforcement affeneiecl I .___Y. 


(U//FOUO) A Buckley Amendment request for academic records cannot be made during an 
assessment. In a predicated investigation, a request for academic records must be made 8 
pursuant to the Buckley Amendment. 
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5.8. (U//FOUO) Standards for Initiating or Approving the Use of an Authorized 
Investigative Method 

(U//FOUO) Prior to initiating or approving the use of an authorized investigative method, an FBI 
employee or approving official must determine whether:. 

A. (U//FOUO) The use of the particular investigative method is likely to further an objective of 
the assessment; 

B. (U//FOUO) The investigative method selected is the least intrusive method, reasonable under 
the circumstances; 

C. (U//FOUO) The anticipated value of the assessment justifies the use of the selected 
investigative method or methods; 

D. (U//FOUO) If the purpose of the assessment is to collect positive foreign intelligence the 
investigative method complies with the AGG-Dom requirement that the FBI operate openly 
and consensually with a United States person, to the extent practicable; and 

E. (U//FOUO) The method is an appropriate use of personnel and financial resources. 

5.9. (U) Authorized Investigative Methods in Assessments and Predicated 
Investigations 

(U) The following investigative methods may be used in assessments and predicated 
investigations: 

A. (U) Obtain publicly available information. (AGG-Dom, Part II.A.4.a and Part VII.L.) 

1 . (U) Scope: Publicly available information” is information that is: 

a. (U) Published or broadcast for public consumption; 

b. (U) Available on request to the public; 

c. (U) Accessible on-line or otherwise to the public; 

d. (U) Available to the public by subscription or purchase; 

e. (U) Made available at a meeting open to the public; 


f. (U) Obtained by visiting any place or attending an event that is open to the public; or 

g. (U) Could be seen or heard by any casual observer not involving unconsented 
intrusion into private places. 
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3 ' C ( ^? U0) A P p,ication: . T his investigative method may be used in assessments, national 

for assTsmn^e tn at |h° nS! Cnmmal investi gations, forei 8 n intelligence collection cases, and 
ror assistance to other agencies. 

4 ’ ^ U ^J Js f /Dlssem,nation: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14 . 

B In 0b I sei 7 ati0n or surveillance not requiring a court order. Surveillance 

noHnfH„ P i yS1Ca ’ Ph ° g I‘f phlC and video surveillance where such surveillance does 
not infringe on a reasonable expectation of privacy and trespass is not required to 
accomplish the surveillance. (AGG-Dom, Part II.A.4.h) 4 

1. (U) Scope 

a ‘ ihfr?r 0) ^ sica * furveil] lance Defined: Physical surveillance is the deliberate 
observation by an FBI employee of persons, places, or events, on either a limited or 

public) ° U tt ,baS1S> m aPUbll ° ° r 3 Semi ' public (e,g -> commerci aI business open to the 


(U//FOUQJ 



b ' ? Surveill unce_ Enhancement Devices: Th e use of m echanic a l d m 

operated by the user 




— n auiriorizea in physical surveillance provided that the device is 

-t USe ^i2- COliec t information in which a..pgrfinn. Has. a rpacnncihlf e 

privacy! 


2. (U/j 


FUU 


• p— may be " 

3 ' inSS.e S nt n n ardS f0r Initiating or Approving Physical Surveillance During 
SecHnr 6 H ?oTu 8 an assessment > In addition to the standards contained in 

— and 5J, the FBI employee and supervisor must consider the following: 
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'• . (U//FOUO) Whether the physical surveillance is rationally related to the 

articulated purpose and objective of the assessment; 

ii. (U//FOUO) Whether the physical surveillance is the least intrusive alternative 
for acquiring needed information; 

m. (U//FOUO) If the physical surveillance is for the purpose of determining a 
pattern of activity, whether there is a logical nexus between the purpose of the 
assessment and the pattern of activity he or she is seeking to determine; and 

w. (U//FOUO) If being conducted in order to gather positive foreign intelligence 
whether the surveillance is consistent with the requirement that the FBI 

employee operate openly and consensually with a United States person, to the 
extent practicable. 



b2 

b7E 


b2 

b7E 


60 

UNCLASSIFIED-FOR OFFICIAL USE ONLY 



UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

e. (U//FOUO) Physical Surveillance during Predicated Investigations: Physical 
surveillance undertak en during a predicated investigation does not require 
supervisory approval \ 


3. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part 
III.B.2-3. 

4. (U) Use/Dissemination: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14 . 

C. (U) Access and examine FBI and other Department of Justice (DOJ) records, and 
obtain information from any FBI or other DOJ personnel. (AGG-Dom, Part II.A.4.b.) 

1 . (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI 
employee may access and examine FBI and other DOJ records and may obtain 
information from any FBI personnel or other DOJ personnel. Access to certain FBI 
records may be restricted to designated FBI personnel because of the sensitive nature of 
the information in the record or the classification of the records. These include, but are 
not limited to: FBI records concerning human source identification; espionage 
investigations; code word; and other compartmented information. 

2. (U//FOUO) Approval: Supervisory approval is not required to use this method, except 
that if the use of records constitutes pattern-based data mining under the Federal Data 
Mining Reporting Act of 2007, it must be reviewed and approved according to paragraph 
3 below. 

3. (U//FOUO) Pattern-Based Data Mining: The vast majority of data analysis performed 
during FBI assessments is based on subjects or events and does not meet the definition of 
pattern-based data mining. Pattern-based data mining is the use of one or more data bases 
to search for persons who fit a set of group characteristics or patterns of behavior (e.g., 
the known characteristics of a particular terrorist organization). Any such analysis based 
solely on racial, ethnic, national origin or religious characteristics is strictly prohibited. 
Sensitive Operations Review Committee (SORC) approval is required for any analytical 
search of FBI or other agency data bases that constitute pattern-based data mining, as 
defined above. Additionally, pursuant to the Federal Data Mining Reporting Act of 2007. 
the FBI must report all agency initiatives that involve the use of pattern-based data 
mining to Congress. 

4. (U//FOUO) Application:' This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies. 

5. (U) Use/Dissemination: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14. 
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D. (U) Access and examine records maintained by, and request information from, other 
federal, state, local, or tribal, or foreign governmental entities or agencies. (AGG-Dom, 
Part II.A.4.C.) 


1 . (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI 

employee may access and examine records maintained by, and request information from, 
other federal, state, local, or tribal, or foreign governmental entities or agencies. When 
requesting information using this authority, care must be taken to ensure the entity 
concerned understands that it is not compelled to provide such information or create a 
new record for the purpose of assisting the FBI. 

2 - (U//FOUO) Approval: Supervisory approval is not required to use this method for 

“routine uses,” unless such approval is required by Memoranda of Understanding (MOU) 
or other agreements for requesting such information. The FBI may request another 
federal agency to disclose Privacy Act-protected records pursuant to the other agency’s 
“routine uses” (5 U.S.C. § 522a[b][3]) or through a written request for a law enforcement 
purpose (5 U.S.C. § 522a[b][7]). Such written requests (for a law enforcement purpose) 
pursuant to 5 U.S.C. § 522a(b)(7) may be made by the Director or his designee, provided 
that such authority may not be delegated below the Section Chief level (28 C.F.R. 

§ 16.40[c]; OMB Guidelines, 40 Fed. Reg. at 28,955). Requests for records or 
information from a foreign government entity or agency must be appropriately 
coordinated through the applicable FBI Legat office, Office of International Operations 
(OIO), INTERPOL, relevant substantive headquarters division, and/or DOJ Office of 
International Affairs, as necessary.. Direct contact is authorized in certain circumstances, 
such as an imminent threat situation. If the analysis of records obtained in this manner 
constitutes pattern-based data mining under the Federal Data Mining Reporting Act of 
2007, it must be reviewed and approved according to Section 5.9.C.3, above. 

(U//FOUO)| " 


(U//FOUO) Records received from an outside en tity and used during an assessment must 
be maintained as part of the appropriate file ( e.g ., | | 

3. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies. 

4. (U) Use/Dissemination: The use and/or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14 . 

E. (U) Use online services and resources (whether non-profit or commercial). (AGG-Dom 
Part II.A.4.d.) ' v 

1 . (U//FOUO) Scope: As part of an assessment or predicated- investigation, an FBI 
employee may use any FBI-approved on-line service or resource that is available by • 
subscription or purchase, including services available only to law enforcement entities. 
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2. (U//FOUO) Approval: Supervisory approval is not required to use this method, although 
subscribing to or purchasing any new service or resource must be done according to FBI 
contracting procedures. 

(U//FOUO) Example: FBI-approved on-line services or resources include, but are not 
limited to: Google, Yahoo, or similar Internet search services; data brokers such as 
ChoicePoint, Westlaw, and Lexis-Nexis; and vehicle, casualty, and property insurance 
claims databases such as Claim-Search. 

3. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies . 

4. (U) Use/Dissemination: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14 . 

F. (U) Interview or request information from members of the public and private entities. 

(AGG-Dom, Part II.A.4.f) 

1. (U//FOUO) Scope: An interview is the questioning of an individual (to include the - 
subject) designed to gather information from the person being interviewed that is accurate, 
pertinent to, and within the scope of an authorized assessment or predicated investigation. 
In the normal course of an interview, the FBI employee should divulge the employee’s 
affiliation with the FBI and the true purpose of the interview. Information requested 
during an interview must be voluntarily provided. If the person who is being interviewed 
expresses a desire not to provide the information, the FBI employee may not state or 
imply in any way that the interviewee is compelled to provide information or that adverse 
consequences may follow if the interviewee does not provide the information. If the 
person being interviewed indicates he or she wishes to consult an attorney, the interview 
must immediately stop. 

2. (U//FOUO) Custodial Interviews: Within the United States, Miranda warnings are 
required to be given prior to custodial interviews if the subject is significantly restricted 
in his/her freedom of action to a degree normally associated with a formal arrest. For 
more information refer to the C1D and CTD PGs and The FBI Legal Handbook for 
Special Agents (LHBSA), Section 7-3-2. 

3. (U//FOUO) Approval: With the exceptions discussed below, interviews do not require 
supervisory approval. 

a. (U//FOUO) Contact With Represented Persons: 

(U//FQUOJ I 
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b. (U//FOUO) Members of the United States Congress and their Staffs: 

(U//FOUO) Generally, FBI employees may take information received from 
congressional offices just as they would take information from other sources, and 
they may act upon it accordingly. 

(U//FQU0j 


c. (U//FOUO) White House Personnel: 
(U//FOI JOtl 


d. (U) FBIHQ Substantive Division Requirements: 


i. (U//FOUOj 






Ii. 

(U//FOUO)] 



1 ‘ 1 

4. (U//FOUO) Requesting Information Without Revealing FBI Affiliation or the True 
Purpose of a Request: 

a. 

(U//FOUO) 




(U//FOUO) 








(U//FOUO)| . I 


XTTkT^nr a n 
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5. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part 
III.B.2-3. 

6. (U) Use/Dissemination: The use or dissemination of information obtained by this method 
must comply with the AGG-Dom and DIOG Section 14 . 

i 

(U) Accept information voluntarily provided by governmental or private entities. 

(AGG-Dom, Part lI.A.4.g.) 

1 . (U//FOUO) Scope: As part of an assessment or predicated investigation, an FBI 

employee may accept information voluntarily provided by federal, state, local, or foreign 
governmental or private entities to include individuals. Voluntarily provided information 
includes, but is not limited to, oral as well as documentary and physical evidence such as: 
a computer hard drive or other electronic media that contains information, paper 
documents containing information, or physical objects (e.g., handgun or narcotics). 

68 

UNCLASSIFIED-FOR OFFICIAL USE ONLY 


UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

2. (U//FOUO) Approval: Supervisory approval is not required to accept voluntarily 
provided information. Personnel may not request nor knowingly accept information 
where disclosure would be prohibited by federal law. See, e.g., 18 U.S.C. § 2702 
(prohibiting an entity providing electronic communications services from divulging 
certain communications and other records, except in certain circumstances). 

3. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part 
III.B.2-3. 

4. (U) Use/Dissemination: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 14 . 

H. (U) Use and recruit human sources in conformity with the Attorney General’s 

Guidelines Regarding the Use of FBI Confidential Human Sources. (AGG-Dom, Part 

II.A.4.e) 

1 . (U//FOUO) The FBI may use and recruit human sources in assessments and predicated 
investigations in conformity with the AGG-Dom, AGG-CHS. the FBI CHSPM. and the 
FBI CHSVSM . In this context, “use” means obtaining information from, tasking, or 
otherwise operating such sources. (AGG-Dom, Part VII .V.) 

2. (U//FOUO) A CHS can be “used” in support of an assessment and a predicated 

investigation or for the purpose of validating, vetting or determining the suitability of 
another CH S as part of an assessment. — | 

I (requires SSA approval in a b7E 

predicated investigation and SAC approval in an assessment. 

4. (U//FOUO) All investigative methods should be evaluated to ensure compliance with the 
admonition that the FBI should use the least intrusive method practicable. That 
requirement should be particularly observed during an assessment when using a CHS 
because the use of a CHS during an assessment may be more intrusive than many other 
investigative methods. Use of a CHS in an assessment should take place only after 
considering whether there are effective, less intrusive means available to obtain the 
desired information. The CHS must comply with all constitutional, statutory, and 
regulatory restrictions and limitations. In addition: 

b2 
b7E 


b. (U//FOUO) A CHS may be directed to seek information about an individual, 
group or organization only to the extent that such information is necessary to 
achieve the specific objective of the assessment. If such contact reveals 
information or facts about an individual, group or organization that meets the 
requirements of a predicated investigation, a predicated investigation may be 
opened, as appropriate. 


a. 


(U//FOUO) CHS use and direction must be limited in focus and scope to what is 
necessary to accomplish the authorized purpose and obi f gthte 
or predicated investigation! 
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DIOG, the DIOG controls and OGC should be immediately notified of the 
conflict. 

5. (U//FOUO) Application: This investigative method may be used in assessments, national 
security investigations, criminal investigations, foreign intelligence collection cases, and 
for assistance to other agencies when it is not otherwise prohibited by AGG-Dom, Part 
II1.B.2. 

(U) Note: When collecting positive foreign intelligence, the FBI must operate openly 
and consensually with a United States person, to the extent practicable. 

6. (U) Use/Dissemination: The use or dissemination of information obtained by this 
method must comply with the AGG-Dom and DIOG Section 1.4 . 

I. (U) Grand jury subpoenas for telephone or electronic mail subscriber information. 
(AGG-Dom, Part II.A.4.i) 

1 . (U//FOUO) Scope: During a type 1 or 2 assessment, an FBI employee may request from 
an appropriate United States Attorney’s Office (USAO) the issuance of a Federal Grand 
Jury (FGJ) subpoena for the limited purpose of obtaining subscriber information. A FGJ 
subpoena, under this provision, may not be requested for the purpose of collecting 
foreign intelligence. For more information regarding FGJ subpoenas, see DIOG Section 
11.9 . 

(U//FOUO) Note: The use of Federal Grand Jury Subpoenas, to include subpoenas for 
telephone or electronic mail subscriber information, is not authorized in a type 3, 4, or 5 
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assessment or in a type 6 assessment or full investigation initiated for the purpose of 
collecting positive foreign intelligence. 

2. (U//FOUO) Approval: In a type 1 or 2 assessment or predicated investigation, 
supervisory approval is not required prior to requesting a USAO to issue a FGJ subpoena 
for telephone or electronic mail subscriber information. 

3. (U) Electronic Communications Privacy Act (ECPA) (18 U.S.C. §§ 2701-2712): 

ECPA, 18 U.S.C. § 2703 states “a provider of electronic communication service or 
remote computing service shall disclose to a governmental entity the: (i) name; (ii) 
address; (iii) local and long distance telephone connection records, or records of sessions, 
times and durations; (iv) length of service (including start date) and types of service 
utilized; (v) telephone or instrument number or other subscriber number or identity, 
including any temporarily assigned network address; and (vi) means and source of 
payment for such service (including any credit card or bank account number), of a 
subscriber to or customer of such service when the governmental entity uses ... a Federal 
Grand Jury [subpoena] . . .” (emphasis added) 

4. (U//FOUO) Application: This investigative method may be used in type 1 and 2 
assessments, national security investigations, criminal investigations, and for assistance 
to other agencies if relevant to an already open type 1 or 2 assessment or predicated 
investigation. This method may not be used to collect positive foreign intelligence 
information. 

5. (U) Use/Dissemination: I I 

b2 
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| The use or dissemination of information obtained by this method must 
comply with the AGG-Dom, DIOG Section 14. and the Federal Rules of Criminal 
Procedure (FRPC) Rule 6. 

5.10. (U) Investigative Methods Not Authorized During Assessments 
(U) The following methods may not be used in an assessment: 

(U//FOUO) Note: For use of lawful investigative methods during the recruitment, assessment 
and validation of a CHS, refer to the AGG-CHS. CHSPM . and CHSVSM . 

A. (U) Mail covers 

Physical searches of per s onal or real property where a warrant or court order is not 
legally required because there is no reasonable expectation of nrivacv (e.g., trash covers) 

C- (U) Consensual monitoring of communications, including consensual computer monitoring 

D- (U) Use of closed-circuit t elevision, direction finders, and other monitoring devices 

E. (U) Polygraph examinations 

F. (U) Undercover operations 
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G. (U//FOUO) Compulsory process, including grand iurv subpoenas (except: subscriber 
Information during type 1 and 2 assessments'), administrative and other subpoenas, and 
National Security Letters 

(U) Accessing store d wire and electronic communications and transactional records 
I- (U) Use of pen registers and trap and trace devices 
J- (U) Electronic surveillance 

(U) Physical searches where there is a reasonable expectation of privacy 

(U) Acquisition of for eign intelligence information in conformity with Title Vll of the 
Foreign Intelligence Surveillance Act £FISA) 

5.11. (U//FOUO) FBI National Collection Requirements 

(U//FOUO) The FBIHQ DI establishes FBI National Collection Requirements after coordination 
with FBIHQ OGC, other FBIHQ substantive Divisions, and Field Offices. An FBI National 
Collection Requirement describes information needed by the FBI to: (i) identify or obtain 
information about potential targets of, or vulnerabilities to, federal criminal activities or threats 
to the national security; or (ii) inform or facilitate intelligence analysis and planning pertinent to 
the FBI’s law enforcement or national security missions. 

ru//Fouoii I 


(U//FQUO) | 

(i) (U//FOUQir 


b2 
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b2 

b7E 


(U//FOUO) Before any investigative activity is initiated in order to respond to an FBI National 
Collection Requirement, an assessment must be initiated or already open. An assessment cannot 
be opened solely based upon an FBI National Collection Requirement. An authorized purpose 
(national security or criminal threat) must exist and an objective must be clearly articulated that 
identifies an authorized purpose prior to opening an assessment. During an assessment, the FBI 
is authorized to collect against any FBI National Collection Requirement that is relevant to the 
assessment because such requirements are issued for information necessary to identify potential 
threats or vulnerabilities (e.g., type 3 assessment) or to collect information necessary for 
intelligence analysis (e.g., type 4 assessment).! 



(U//FOUO) An FBI Field Office Collection Requirement describes information needed by the 
field to: (i) identify or obtain information about potential targets of or vulnerabilities to federal 
criminal activities or threats to the national security; or (ii) inform or facilitate intelligence 
analysis and planning pertinent to the FBI’s law enforcement or national security missions. 

(U//FOUO) Before any investigative activity may be conducted to respond to an FBI Field ■ 
Office Collection Requirement, an assessment must be initiated or already open. An assessment 
cannot be opened solely based upon an FBI Field Office Collection Rermirementl 


b2 
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b2 
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me uijAj contains detailed guidance regarding the Field Office Collection Requirements. ™ 

5.13. (U) Retention and Dissemination of Privacy Act Records 

(U//FOUO) The Privacy Act restricts the maintenance of records relating to the exercise of First 
Amendment rights by individuals who are United States persons. Such records may be 
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maintained if the information is pertinent to and within the scope of authorized law enforcement 
activities or for which there is otherwise statutory authority for the purposes of the Privacy Act 
(5 U.S.C. § 522a[e][7]). Activities authorized by the AGG-Dom are authorized law enforcement 
activities. Thus, information concerning the exercise of First Amendment rights by United States 
persons may be retained if it is pertinent to or relevant to the FBI’s law enforcement or national 
security activity. Relevancy must be determined by the circumstances. If the information is not 
relevant to the law enforcement activity being conducted, then it may not be retained. For more 
information see DIOG Section 4 . (AGG-Dom, Part I.C.5) 

(U//FOUO) Even if information obtained during an assessment does not warrant opening a 
predicated investigation, the FBI may retain personally identifying information for criminal and 
national security purposes. In this context, the information may eventually serve a variety of 
valid analytic purposes as pieces of the overall criminal or intelligence picture are developed to 
detect and disrupt criminal and terrorist activities. In addition, such information may assist FBI 
personnel in responding to questions that may subsequently arise as to the nature and extent of 
the assessment and its results, whether positive or negative. Furthermore, retention of such 
information about an individual collected in the course of an assessment will alert other 
Divisions or Field Offices considering conducting an assessment on the same individual that the 
particular individual is not a criminal or national security threat. As such, retaining personally 
identifying information collected in the course of an assessment will also serve to conserve 
resources and prevent the initiation of unnecessary assessments and other investigative activities. 

(U) Marking Closed Assessments That Contain Personal Information: Information obtained 
during an assessment that has insufficient value to justify further investigative activity may 
contain personal information. As a result: (i) when records retained in an assessment specifically 
identify an individual or group whose possible involvement in criminal or national security- 
threatqning activity was checked out through the assessment; and (ii) the assessment turns up no 
sufficient basis to justify further investigation of the individual or group, then the records must 
be clearly annotated as follows: “It is noted that the individual or group identified during the 
assessment does not warrant further FBI investigation at this time. It is recommended that this 
assessment be closed.” Extreme care should be taken when disseminating personally identifiable 
information collected during an assessment that does not lead to sufficient facts to open a 
predicated investigation. If personal information from the assessment is disseminated outside the 
FBI according to authorized dissemination guidelines and procedures, it must be accompanied by 
the required annotation that the assessment involving this individual o r group did not warrant 

further investigation by the FBI at the time the assessment was closed. 1 . 1 


I Moreover. an FBI 

employee, who shares information from such a closed assessment file, must ensure that the 
specific annotation (as discussed above) is included with the shared information. 


5.14. (U) Assessment File Records Management and Retention 
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_ 1 R ecor ds 

rtlusi oe retained according to National Archives and Records Administration (NARA) 
regulations. 

(U//FOUO)| 

| The retention of 

recoras in Uuardian, or any successor information technology system, must be retained 
according to NARA regulations. 

(U//FOUO) Assessments that require prior supervisory annmval mint havf»i I 


I imust oe approved by the SiSA o r SlAj [ If additional objectives arise 

during the assessmen t, they must be | I approved by the SSA or SIA, and 

1 | Assessment classification files must be retained according to NARA 

regulations. 
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6. (U) Preliminary Investigations 


6.1. (U) Overview 

(U) The AGG-Dom authorizes a second level of investigative activity — predicated investigations. 
Predicated investigations that concern federal crimes or threats to the national security are 
subdivided into preliminary investigations and full investigations. Preliminary investigations 
may be initiated on the basis of any “allegation or information” indicative of possible criminal 
activity or threats to the national security. 

6.2. (U) Purpose and Scope 

(U//FOUO) Preliminary investigations may be carried out to detect, obtain information about, or 
prevent or protect against federal crimes or threats to the national security. However, a 
preliminary investigation cannot be initiated or used solely for the purpose of collecting against 
Positive Foreign Intelligence Requirements, or for conducting enterprise investigations. 
Intelligence responsive to Positive Foreign Intelligence Requirements, FBI National Collection 
Requirements and FBI Field Office Collection Requirements may be collected incidental to a 
preliminary investigation concerning another person, organization, or entity. If Positive Foreign 
Intelligence Requirement, FBI National Collection Requirement or FBI Field Office Collection 
R equirement information is incidentally collected in a preliminary investigation, it should be 
forwarded to the FIG for evaluation and potential dissemination against collection requirements. 

(U) In preliminary investigations, the immediate objectives include such matters as: determining 
whether a federal crime has occurred or is occurring, or if planning or preparation for such a 
crime is taking place; identifying, locating, and apprehending the perpetrators; obtaining 
evidence needed for prosecution; or identifying threats to the national security. 

(U) The investigation of threats to the national security may constitute an exercise of the FBI’s 
criminal investigation authority as well as its authority to investigate threats to the national 
security. As with criminal investigations, detecting and solving crimes and arresting and 
prosecuting the perpetrators are likely objectives of investigations relating to threats to the 
national security. These investigations, however, serve important purposes outside the ambit of 
normal criminal investigations, by providing the basis for decisions concerning other measures 
needed to protect the national security. 

6.3. (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to further ensure that civil liberties are not undermined by the 
conduct of criminal and national security investigations, every preliminary investigation under 
this subsection must have an identified authorized purpose and adequate predication. 

(U) No investigative activity, including preliminary investigations, may be taken solely on the 
basis of activities that are protected by the First Amendment or on the race, ethnicity, national 
origin or religion of the subject. Preliminary investigations of individuals, groups or 
organizations must focus on activities related to the threats and or crimes being investigated, not 
solely on First Amendment activities or on the race, ethnicity, national origin or religion of the 
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subject. In this context, it is particularly important clearly to identity and document the law 
enforcement or national security basis of the preliminary investigation. 

(U) Example: Individuals or groups who communicate with each other or 
with members of the public in any form in pursuit of social or political 
causes — such as opposing war or foreign policy, protesting government 
actions, promoting certain religious beliefs, championing particular local, 
national, or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes — have a 
fundamental constitutional right to do so. A preliminary investigation may not 
be initiated based solely on the exercise of these First Amendment rights. 

(U) The AGG-Dom present investigators with a number of authorized investigative methods in 
the conduct of a preliminary investigation. Considering the effect on the privacy and civil 
liberties of individuals and the potential to damage the reputation of individuals, some of these 
investigative methods are more intrusive than others. The least intrusive method feasible is to be 
used, but the FBI must not hesitate to use any lawful method consistent with the AGG-Dom. A 
more intrusive method may be warranted in light of the seriousness of a criminal or national 
security threat. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence and/or evidence, 
FBI employees can effectively execute their duties while mitigating the potential negative impact 
on the privacy and civil liberties of all people encompassed within the investigation, including 
targets, witnesses, and victims. This principle is not intended to discourage FBI employees from 
seeking relevant and necessary intelligence, information, or evidence, but rather is intended to 
encourage FBI employees to choose the least intrusive — but still effective means — from the 
available options to obtain the material. 

6.4. (U) Legal Authority 

A. (U) Criminal Investigations 

(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively 
to another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [1]) 

(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically, the FBI has jurisdiction to investigate felony killings of 
state law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers 
(28 U.S.C. § 540A), and serial killers (28 U.S.C. § 540B). Authority to investigate these 
matters is contingent on receiving a request by an appropriate state official. 

B. (U) Threats to the National Security 

(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders. Attorney General authorities, and various statutory sources. (See E.O. 12333 - 50 
U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.) 

(U) Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage, and assassination, conducted by, for, or ’ 
on behalf of foreign powers, organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General, consistent with Executi ve Order 12333 or any 
successor order. (AGG-Dom, Part VII.S) 
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6.5. (U) Predication 

(U) A preliminary investigation may be initiated on the basis of “information or an allegation” 
indicating the existence of a circumstance described as follows: 

A. (U) An activity constituting a federal crime or a threat to the national security has or may 
have occurred, is or may be occurring, or will or may occur and the investigation may 
obtain information relating to the activity or the involvement or role of an individual, group, 
or organization in such activity. (AGG-Dom, Part II.B.3) 

B. (U) An individual, group, organization, entity, information, property, or activity is or may 
be a target of attack, victimization, acquisition, infiltration, or recruitment in connection 
with criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information that would help to protect against such activity or 
threat. (AGG-Dom, Part II.B.3) 

(U//FOUO)! ■ 



6.6. (U//FOUO) Standards for Initiating or Approving a Preliminary Investigation 

(U) Before initiating or approving the conduct of a preliminary investigation, an FBI employee 
or approving official must determine whether: 

A. (U//FOUO) An authorized purpose and adequate predication exist for initiating a 
preliminary investigation; 

B. (U//FOUO) The preliminary investigation is not based solely on the exercise of First 

Amendment activities or on the race, ethnicity, national origin or religion of the subject- 
and J 

C. (U//FOUO) The preliminary investigation is an appropriate use of personnel and financial 
resources. 

6.7. (U) Duration, Approval, Notice, Documentation and File Review 

A. (U//FOUO) Initiation: The purpose of and predication for a preliminary investigation must 
e ocumented in the initiating EC. The effective date of the preliminary investigation is 
the date the final approval authority (e.g., SSA or SAC) approves the EC. b2 

1. (U//FOUQ) The initiation of a preliminary investigation by the Field Office rennirpg 
prior approval of the SSA,| 
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2. (U//FOUO) The initiation of a preliminary investigation hv FBIHQ rf»nn irec nrtr\r 
approval of the Unit Chief! 


3. (U//FOUO) Sensitive Investigative Matter: The initiation of a preliminary 
investigation involving a sensitive investigative matter : 

a. (U//FOUO) Initiated by a Field Office: requires CDC review, SAC approval, 
and written notification to the appropriate FBIHQ Unit Chief and Section Chief. 
Additionally, written notification must be made by the Field Office to the United 
States Attorney or by the appropriate FBIHQ Section to the DOJ Criminal 
Division or NSD as soon as practicable but in al l events no later than 30 calendar 
days after the initiation of s uch an investigation i 


ctnye until Luc review and SAC approval is acquired and notice is furnished as 
specified above. 

b. (U//FOUO) Initiated by FBIHQ: requires OGC review. Section Chief approval, 
and written notification to the United States Attorney and the appropriate Field 
Office or the DOJ Criminal Division or NSD as soon as practicable but in all 
events no later than 30 calendar days after the initiation of such an investigation. 


I — |must cease until OGC review and Section 

Chief approval is acquired and notice is furnished as specified above. (AGG-Dom 
Part II.B.5.a) 

4. (U//FOUO) The Executive Assistant Director (EAD) for the National Security Branch 
must notify the Deputy Attorney General if FBI Headquarters disapproves a Field 
Office’s initiation of a preliminary investigation relating to a threat to the national 
security on the ground that the predication for the investigation is insufficient, and the 
EAD for the National Security Branch is responsible for establishing a system that will 
allow for the prompt retrieval of such denials. (AGG-Dom, Part Il.B.5.d) 

B. (U//FOUO) Extension: A preliminary investigation must be concluded within six months 
of its initiation but may be extended for up to six months by the SAC. This extension 
authority may not be delegated by the SAC to the ASAC. Extensions of preliminary 
investigations beyond a year are discouraged and may only be approved by the appropriate 
FBIHQ Unit and Section for “good cause.” (AGG-Dom. Part TI B 4 a in Nnfo- 1 I 


(U//FOUO) The following factors must be used to determine if “good cause” exists to 
extend the preliminary investigation beyond one year: 


b2 
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• (U//FOUO) Whether logical investigative steps have yielded information that 
tends to inculpate or exculpate the subject; 

• (U//FOUO) The progress that has been made toward determining whether a full 
investigation should be opened or the preliminary investigation should be closed; 

• (U//FOUO) Whether, based on the planned course of investigation for the 
following six months, it is reasonably likely that information will be obtained that 
will lead to predication for a full investigation, thereby warranting an extension 
for another six months, or will lead to exculpatory information, thereby 
warranting closing the preliminary investigation; and 

• (U//FOUO) Whether adequate predication has been developed to justify opening a 
full investigation or whether sufficient information has been developed that justify 
closing the preliminary investigation. 

C. (U//FOUO) Closing: When closing a preliminary investigation, the Field Office or FBIHQ 
will provide the reason for closing the investigation. When closing a preliminaiy 
investigation, the SSA or Unit Chief must ensure that all pending investigative methods 
have been completed/terminated (e.g., mail covers and pen register/trap and trace). 

1. (U//FOUO) Closing a p reliminary investigation initiated hv a Field OffW 
approval from the SSA. 1 


2. (U//FOUO) Closing a preliminary investigation initiated by FBIHQ requires approval 
from the Unit Chief and notification to the appropriate Field Office. 

3. (U//FOUO) Closing a preliminary investigation initiated by a Field Office involving a 
j sensitlve investigative matter requires apnrrj val from the SAC | 

4. (U//FOUO) Closing a preliminary investigation initiated by FBIHQ involving a 

^sensitive investigative matter requires appro val from the Section Chief | ~ | 


D. (U//FOUO) Conversion: When converting a preliminary investigation to a full 
investigation, see Section 7 for approval and notification requirements. 

E ' in / f° UO) FiIeReview ; Supervisory file reviews must be conducted at least once every 
90 days m accordance with S ection 3.4 . File reviews for probationary FBI employees must 
be conducted at least every 60 days. 


6 . 8 . 


(U//FOUO) Standards for Initiating or Approving the Use of an Authorized 
Investigative Method 


(U//FOUO) Prior to initiating or approving the use of an investigative method, an FBI emplovee 
or approving official must determine whether: ^ 

A ' Sw^relS investigative method is likely to further the purpose of 

B ' ttedrcu^^ mSth0d SdeCted ‘ S tHe IeaSt intrusive method, reasonable under 
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C. (U//FOUO) The method to be used is an appropriate use of personnel and financial resources. 

6.9. (U) Authorized Investigative Methods in Preliminary Investigations 

A. (U) All lawful methods may be used in a preliminary investigation, except for mail opening, 
physical search requiring a Federal Rules of Criminal Procedure (FCRP) Rule 41 search 

A or a FISA order ’ electronic surveillance requiring a judicial order or warrant, or Title 
Vil FISA requests. Authorized methods include, but are not limited to, those listed below. 
Some of the methods listed are subject to special restrictions or review or approval 
requirements. (AGG-Dom, Part V.4.A) 

B. (U//FOUO) A complete discussion of the investigative methods, including approval 
requirements, is contained in Sections 5 and JI- The use or dissemination of information 
obtained by the use of the below methods must comply with the AGG-Dom and DIOG 
Section 14 . 


1 • (U) Obtain publicly available information . 

2 ‘ (U) Ac c e ss and exam ine F BI and other DOJ records, and obtain information from ,n« 
FBI or other DOJ personnel . 


3 - (U) Agcess and examine records maint ained by. and request information from, other 
federal, state, local, or tribal, or foreign governmental entities or agencies . 

4 - Use online services and resources (whether non-profit or commercial). 

5- (U) Use. and recruit huma n sources in conformity with the AGG-CHS . 

6 ‘ ( u ) Interview or request information from members of the public and private entities . 

7< (U) Accept information voluntarily p rovided by governmental or private entities 

8 - (U) Engage in observatio n or surveillance not requiring a court order 

9 ' W Grand Jury Subpoenas for telep hone or electronic mail subscriber information (see 
also number 1 6, below). ‘ " 

10. (U) Mail covers . (AGG-Dom, Part V.A.2) 

1 £b. y . sical searches of person al or real property where a warrant or court order is not 
le gally required because th er e is no reasonable expectation of privacy (e. o open fields 

trash covers). (AGG-Dom, Part V.A.3) 


2 ‘ Co nsensual monitoring of communications , including consensual computer 
monitoring, subject to legal review by the CDC or the FBI OGC. When a sensitive 
monitoring circumstance is involved, the monitoring must be approved by the DOJ 

V ! ° r ’ if the investigation con cems a threat to the national security, by the 
OJNSD. (AGG-Dom, Part V.A.4) Sensitive monitoring circumstances include: 


a. (U) Investigation of a member of Congress, a federal judge, a member of the 

Executive Branch at Executive Level IV or above, or a person who has served in such 

thf P^vious two years (Executive Level I through IV are defined in 5 
U.b.L. §§ 5312-5315); 


b. (U) Investigation of the Governor, Lieutenant Governor, or Attorney General of any 
state or territory, or a judge or justice of the highest court of any state or territory, 
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concerning an offense involving bribery, conflict of interest, or extortion related to 
the performance of official duties; 

c. (U) A party to the communication is in the custody of the Bureau of Prisons or the 
United States Marshal Service or is being or has been afforded protection in the 
Witness Security Program; or 

d. (U) The Attorney General, the Deputy Attorney General, or an Assistant Attorney 
General has requested that the FBI obtain prior approval for the use of consensual 
monitoring in a specific investigation. (AGG-Dom, Part VII.A and O) 

(U//FOUO) Note: See classified appendix for additional information. 


b2 
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13. (U) Use of c losed-circuit television, direction finders, and other monitoring devices , 
subject to legal review by the CDC or the FBI OGC. (The methods described in this 
paragraph usually do not require a court order or warrant unless they involve an intrusion 
into an area where there is a reasonable expectation of privacy or non-consensual 
monitoring of communications, but legal review is necessary to ensure compliance with 
all applicable legal requirements.) (AGG-Dom, Part V.A.5) 

14. (U) Polygraph examinations . (AGG-Dom, Part V.A.6) ' 

15 - ( u ) Unde rcover operations . In investigations relating to activities in violation of federal 
criminal law that do not concern threats to the national security or foreign intelligence, 
undercover operations must be carried out in conformity with The Attorney General’s 
Guidelines on F ederal B u reau of Investigation Undercover Operations . Investigations 
that are not subject to the preceding sentence because they concern threats to the national 
security or foreign intelligence undercover operations involving religious or political 
organizations must be reviewed and approved by FBI Headquarters, with participation by 
the DOJ NSD in the review process. (AGG-Dom, Part V.A.7) 

16. (U) Compulsory pro cess as authorized by law, including grand jury subpoenas and other 
sub poenas. National Security Letters (15 U.S.C. §§ 1681u, I681v; 18 U.S.C. § 2709; 12 
U.S.C. § 341 4[a] [5][A]; 50 U.S.C. § 436), and FISA orders for the production of tangible 
things. (50 U.S.C. §§ 1861-63). (AGG-Dom, Part V.A.8) 

1 7- (U) Accessing stored wi re and electronic communications and transactional records in 
conformity with chapter 121 of title 18, United States Code (18 U.S.C. §§ 2701-2712). 
(AGG-Dom, Part V.A.9) 

18 - ( u ) Use of pen registers and trap and trace devices in conformity with chapter 206 of title 
18, United States Code (18 U.S.C. §§ 3121-3127) or FISA (50 U.S.C. 55 1841-1846). 
(AGG-Dom, Part V. A. 10) 


(U//FOUO)r 
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6.10. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment 

(U//FOUO) The title/case caption of the opening or subsequent EC for a preliminary 
investigation involving a sensitive investigative matter must contain the words “Sensitive 
Investigative Matter.” DIOG Section 10 contains the required approval authority and factors for 
consideration when determining whether to initiate or approve a predicated investigation 
involving a sensitive investigative matter. 

A. (U//FOUO) Sensitive Investigative Matter: An investigative matter involving the activities 
of a domestic public official or political candidate (involving corruption or a threat to the 
national security), religious or political organization or individual prominent in such an 
organization, or news media, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBI Headquarters and 
other DOJ officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, “judgment” means 
that the decision of the authorizing official is discretionary, DIOG Section 1 0 and/or 
DIOG classified Appendix G definel 


B. (U//FOUO) Academic Nexus :f 


(U//FOUO) The sensitivity related to an academic institution arises from the American 
tradition of “academic freedom” (e.g., an atmosphere in which students and faculty are free 
to express unorthodox ideas and views and to challenge conventional thought without fear of 
repercussion). Academic freedom does not mean, however, that academic institutions are off 
limits to FBI investigators in pursuit of information or individuals of legitimate investigative 
interest. 

(U//FOUO)| 

| ~1 see the LHUCi classified Appendix G . 

C. (U//FOUO) Buckley Amendment: Although not a sensitive investigative matter, a request 
for “academic records” must only be made pursuant to the provisions of the Buckley 
Amendment (The Family Educational Rights and Privacy Act of 1974 20 U S C § 1232Igl 
as amended by Public Law 107-56 [“USA PATRIOT Act”]). An FBI employee is prohibited 
^om receiving academic records” that have not been properly requested pursuant to the 
Buckley Amendment. The definition of “academic records” is very broad and covers almost 
all records about a student other than public, student directory-type information published by 
the institution. The Buckley Amendment contains a penalty provision for those institutions 
that improperly provide academic records to law enforcement app.np.ip; I I 


A Buckley Amendment request for academic records cannot be made during an assessment. 
In a predicated investigation, a request for academic records must be made pursuant to the 
Buckley Amendment . 
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6.11. (U) Program Specific Investigative Requirements 

(U//FOUO) Because of the many investigative programs within the FBI, a single universal 
requirement will not adequately address every program. To facilitate compliance within an 
existing program, the FBI employee should consult the relevant program policy guidance . 
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7. (U) Full Investigations 


7*1* (U) Overview 

(U//FOUO) The AGG-Dom authorizes a second level of investigative activity — predicated 
investigations. Predicated investigations that concern federal crimes or threats to the national 
security are subdivided into preliminary investigations and full investigations. Full investigations 
may be initiated if there is an “articulable factual basis” of possible criminal or national threat 
activity, as discussed in greater detail in Section 7.5 . below. There are three types of full 
investigations: (i) single and multi-subject; (ii) enterprise : and (iii) positive foreign intelligence 
collection. 

7.2. (U) Purpose and Scope 

(U) Full investigations may be initiated to detect, obtain information about, or prevent or protect 
against federal crimes or threats to the national security or to collect foreign intelligence. 

(U) The objective of a full investigation includes: determining whether a federal crime is being 
planned, prepared for, occurring or occurred; identifying, locating, and apprehending the 
perpetrators; obtaining evidence for prosecution; identifying threats to the national security; 
investigating an enterprise (as defined in DIOG Section 8 ): or collecting positive foreign 
intelligence, 

(U) The investigation of threats to the national security can be investigated under both the FBI’s 
criminal investigation authority and its authority to investigate threats to the national security. As 
with criminal investigations, detecting and solving crimes, gathering evidence and arresting and 
prosecuting the perpetrators are frequently the objectives of investigations relating to threats to 
the national'security. These investigations also serve important purposes outside the ambit of 
normal criminal investigations, however, by providing the basis for decisions concerning other 
measures needed to protect the national security. 

(U//FQUQ)| 1 


(U//FOUO) A full investigation solely for the collection of positive foreign intelligence extends 
the sphere of the FBI’s information gathering activities beyond federal crimes and threats to the 
national security and permits the FBI to seek information regarding a broader range of matters 
relating to foreign powers, organizations, or persons that may be of interest to the conduct of the 
United States’ foreign affairs. (See DIOG Section 9) 

7.3. (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to further ensure that civil liberties are not undermined by the 
conduct of criminal and national security investigations, every full investigation under this 
subsection must have an identified authorized purpose and adequate predication. 
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(U) No investigative activity, including full investigations, may be taken solely on the basis of 
activities that are protected by the First Amendment or on the race, ethnicity, national origin or 
religion of the subject. Full investigations of individuals, groups or organizations must focus on 
activities related to the threats or crimes being investigated, not solely on First Amendment 
activities or on the race, ethnicity, national origin or religion of the subject. In this context, it is 
particularly important clearly to identify and document the law enforcement or national security 
basis of the full investigation. 

(U) Example: Individuals or groups who communicate with each other or 
with members of the public in any form in pursuit of social or political 
causes such as opposing war or foreign policy, protesting government 
actions, promoting certain religious beliefs, championing particular local, 
national, or international causes, or a change in government through non- 
criminal means, and actively recruit others to join their causes — have a 
fundamental constitutional right to do so. A full investigation may not be 
initiated based solely on the exercise of these First Amendment rights. 

(IJ) The AGG-Dom authorize all lawful investigative methods in the conduct of a full 
investigation. Considering the effect on the privacy and civil liberties of individuals and the 
potential to damage the reputation of individuals, some of these investigative methods are more 
intrusive than others. The least intrusive method feasible is to be used, but the FBI must not 
hesitate to use any lawful method consistent with the AGG-Dom. A more intrusive method may 
be warranted in light of the seriousness of a criminal or national security threat or the importance 
of a foreign intelligence requirement. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence or evidence, FBI 
employees can effectively execute their duties while mitigating the potential negative impact on 
the privacy and civil liberties of all people encompassed within the investigation, including 
targets, witnesses, and victims. This principle is not intended to discourage FBI employees from 
seeking relevant and necessary intelligence, information, or evidence, but rather is intended to 
encourage FBI employees to choose the least intrusive — but still effective means — from the 
available options to obtain the material. 

(U) Because the authority to collect positive foreign intelligence enables the FBI to obtain 
information pertinent to the United States’ conduct of its foreign affairs, even if that information 
is not related to criminal activity or threats to the national security, the information gathered may 
concern lawful activities. The FBI must accordingly operate openly and consensually with a 
United States person to the extent practicable when collecting positive foreign intelligence that 

does not concern criminal activities or threats to the national security. 

7.4. (U) Legal Authority 
A. (U) Criminal Investigations 

(U) The FBI has statutory authority to investigate all federal crime not assigned exclusively 
to another federal agency. (See 28 U.S.C. § 533; 18 U.S.C. § 3052; 28 C.F.R. § 0.85 [1].) 

(U) The FBI also has special investigative jurisdiction to investigate violations of state law in 
limited circumstances. Specifically, the FBI has jurisdiction to investigate felony killings of 
state law enforcement officers (28 U.S.C. § 540), violent crimes against interstate travelers 
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(28 U.S.C. § 540A), and serial killers (28 U.S.C. § 540B). Authority to investigate these 
matters is contingent on receiving a request by an appropriate state official. 

B. (U) Threats to the National Security 

(U) The FBI has authority to investigate threats to the national security pursuant to executive 
orders, Attorney General authorities, and various statutory sources. (See E.O. 12333 - 50 
U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.) 

(U) Threats to the national security” are specifically defined to mean: international terrorism; 
espionage and other intelligence activities, sabotage, and assassination, conducted by, for, or ’ 
on behalf of foreign powers, organizations, or persons; foreign computer intrusion; and other 
matters determined by the Attorney General, consistent with Executive Order 1233.3 or any 
successor order. (AGG-Dom, Part VII.S) ~ 

C. (U) Foreign Intelligence Collection 


The LB! authority , to col lect-f oreign intelligence derives from a mixture of administrative 
and statutory sources. (See E.O. 12333; 50 U.S.C. §§ 401 et seq.; 50 U.S.C. §§ 1801 et seq.; 
28 U.S.C. § 532 note (incorporates the Intelligence Reform and Terrorism Protection Act 
P.L. 108-458 §§2001-2003). 

(U) “Foreign Intelligence” is defined as information relating to the capabilities, intentions, or 
activities of foreign governments or elements thereof, foreign organizations or foreign 
persons, or international terrorists. (AGG-Dom, Part VII.E) 

7.5. (U) Predication 

(U) A full investigation may be initiated if there is an “articulable factual basis” that reasonably 
indicates one of the following circumstances exists: 


A. (U) An activity constituting a federal crime or a threat to the national security has or may 

ave occurred, is or may be occurring, or will or may occur and the investigation may obtain 
intormation relating to the activity or the involvement or role of an individual, group or 
organization in such activity. ’ 

B. (U) An individual, group, organization, entity, information, property, or activity is or may be 
a target of attack, victimization, acquisition, infiltration, or recruitment in connection with 
criminal activity in violation of federal law or a threat to the national security and the 
investigation may obtain information that would help to protect against such activity or threat. 

C. (U) The investigation may obtain foreign intelligence that is responsive to a Positive Foreign 
Intelligence Requirement, as defined in DIOG Section 7.4.C. 

(U//FOUO) I 


(i) (U//FOUO} :h? 

| ~1 b7E 

(ii) . (U//FOUOI— " 1 , 
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(iii) 


7.6. (U//FOUO) 

(U//FOUO) Before initiating or approving the conduct of a full investigation, an FBI employee 
or approving official must determine whether: 

A. (U//FOUO) An authorized purpose and adequate predication exist for initiating a full 
investigation; 

B. (U//FOUO) The full investigation is based on factors other than the exercise of First 
Amendment activities or the race, ethnicity, national origin or religion of the subject; and 

C. (U//FOUO) The full investigation is an appropriate use of personnel and financial resources. 

7.7. (U) Duration, Approval, Notice, Documentation and File Review 

A. (U//FOUO) Initiation: The purpose of and predication for a full investigation must be 
documented in the initiating EC. The effective date of the full investigation is the date the 
final approval authority (e.g., SSA or SAC) approves the EC. 

1. (U//FOUO) By a Field Office: The initiation of a full investigation for circumstances 
described in Sections. 7.5. A and 7.5. B by a Field Office requires prior approval of the 
SSA with written notification to the appropriate FBIHQ substantive Unit. The initiation 
of a full investigation of a United States person relating to a threat to the national 
security for circumstances described in Sections 7.5.A and 7.5.B requires the approval 
of the Field Office SSA with written notification to the appropriate FBIHQ substantive 
Unit. The FBIHQ substantive Unit must notify DOJ NSD as soon as practicable but in 
all events within 30 calendar days after the initiation of the investigation. 

2. (U//FOUO) By FBIHQ: The initiation of a full investigation for circumstances 
described in Sections 7.5.A and 7.5.B by FBIHQ requires prior approval of the Unit 
Chief with written notification to the appropriate Field Office. The initiation of a full 
investigation by FBIHQ of a United States person relating to a threat to the national 
security for circumstances described in Sections 7.5.A and 7.5.B requires the approval 
of the Unit Chief with written notification to the appropriate Field Office and notice to 

DOJ NSD as soon as practicable but in all events within 30 days after initiation of the 
investigation. 



Standards for Initiating or Approving a Full Investigation 



(U//FOUO) Sensitive Investigative Matter: The initiation 
involving a sensitive investigative matter: 


of a full investigation 


a. 


(U//FOUO) By a Field Office: requires CDC review, SAC approval, and written 
notification to the appropriate FBIHQ substantive Unit Chief and Section Chief. 
Additionally, the Field Office must notify, in writing, the United States Attorney, 
if required. The appropriate FBIHQ Section must notify, in writing, the DOJ 
Criminal Division or NSD as soon as practicable, but no later than 30 calendar 
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until CDC review and SAC approval are acquired and notice is furnished as 
specified above. 

b. (U//FOUO) By FBIHQ: requires OGC review. Section Chief approval, and 
written notification to the United States Attorney and the appropriate Field Office 
or the DOJ Criminal Division or NSD as soon as practicable, but no later than 30 
r calendar da y s after the initiation of such an investigation. The notW m ust identify 

If see 


massmet ra ppendix Yor [ 


J until OGC review and Section Chief approval are acquired and notice is 

ioUa/1 rtr, ~ - J r i ^ 1 


B. 


• — - v mi v t 

furnished as specified above. (AGG-Dom, Part II.B.5.a) 

4. (U//FOUO) The initiation of a full investigation in order to collect positive foreign 
intelligence must be approved as provided in Section 9 . Additionally, written 
notification to FBIHQ CMS and DOJ NSD is required as soon as practicable but no 
later than 30 calendar days after the initiation of the investigation. 

5. (U//FOUO) The EAD for the National Security Branch must notify the Deputy 
Attorney General if FBI Headquarters disapproves a Field Office’s initiation of a full 
investigation relating to a threat to the national security on the ground that the 
predication for the investigation is insufficient, and the EAD for the National Security 
Branch is responsible for establishing a system that will allow for the prompt retrieval 
of such denials. (AGG-Dom, Part II.B.5.d) 

(U//FOUO) Closing: When closing the full investigation, the Field Office or FBIHQ will 
provide the reason for closing the investigation. When closing a full investigation, the SSA or 
Unit Chief must ensure that all pending investigative methods have been completed/ 

covers and P en register/trap and trace). Although there is no duration 
activity be"fcxta"ed VeSt ' Sa, ‘°"' mVeStigati °" mUst be closed “P°" “'1 investigative 

L p ing a ful1 investigation initiated fa y a F ^ld Office requires approval ' 

CD* ' ■ — ^3 

Closing a . ful . Unysstigafion initiaft?d - hvJ . R l H Q requires approval from the 


2. (U//FOUO; 
Unit Chief 


3 ‘ , ( U//FQU Q) Closing a . fu lUqvestigation initiated by a Field Office involving ar 
I approva l from the SACl 


4 ' , (U//FOUO) . C l osing- a- fi i liJi Yestigation initiated by FBIHQ involving ; 
J Japproval from the Section Chief! " 


J 


(U//FOUO) Closing a f ull investigation 


approval of FBI PlQ CMS 
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C. (U//FOUO) File Review: Supervisory file reviews must be conducted at least once every 90 
days tn accordance with Section 3.4. File reviews for probationary FBI employees must be 
conducted at least every 60 days. 

D. (U//FOUO) Annual Letterhead Memorandum: Annual letterhead memoranda regarding 

the status of full investigations are not re quired bv the AGG-Dnm- I 1 


7.8. (U//FOUO) Standards for Initiating or Approving the Use of an Authorized 
Investigative Method 

(U//FOUO) Prior to initiating or approving the use of an investigative method, an FBI employee 

or approving official must determine whether: 

A ' J J// f? U °' ) The USe of the P articular investigative method is likely to further the purpose of 
the full investigation; ’ 

B. (U//FOUO) The investigative method selected is the least intrusive method, reasonable under 
the circumstances; 

C. (U//FOUO) If the full investigation is for collecting positive foreign intelligence, the FBI 
must operate openly and consensually with a United States person, to the extent practicable; 


D. (U//FOUO) The method to be used is an appropriate use of personnel and financial resources. 
7.9. (U) Authorized Investigative Methods in Full Investigations 

(U) All lawful methods may be used in a full investigation, unless the investigation is to collect 
toreign intelligence. The use or dissemination of information obtained by the use of these 
methods must comply with the AGG-Dom and DIOG Section 14 . See foreign intelligence 
collection Se ction 9 for more information regarding use of authorized investigative methods. 

A- (U) Obtain publicly available information . 

B ' ~?. e . S . S and examine FB1 and other DO J r ecords, and obtain information from anv FBI or 
other DQJ personnel . ~ ~~~ 


C - (U) Access and examine records m ainta ined by. and request information from, other federal 
s tate, local, or tribal, or foreign g overnmental entities or agencies . 

D - Ose online services and resourc es (whether non-profit or commercial). 

(U) Use and r ecruit human sources in conformity with the AGG-CHS . 

F> (U) Interview or request information from m embers of the nublic and nrivam ^ntiti^c 

G - (U) A ccept information volunta rily p rovided bv governmental or private entities 

E ngage in ob serva tion or surveillance not requiring a court order . 

1 t- g ^ JUrV gub P° enas for telephone or ele ctronic mail subscriber information 

J- (U) Mail covers . (AGG-Dom, Part V.A.2) 
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K ‘ £ ffi VSiCal Se fL CheS of P ersnnal or real pr °nerfv w here a warrant or court ardor j s n rn- 

Pan vaI)'^ iS n ° f£aS ° nahl " SmsSS&m ° M ^ < e - 8 - 

L ' ( U ) ^ ei | lsual monitoring of communications , including consensual computer monitoring 
abject o legal review by the CDC or the FBI OGC. When a sensitive Zitoring 8 ’ 
cumstance is involved, the monitoring must be approved by the DOJ CriminalDivision or 
Part VA^) 183 ^ 011 C ° nCemS a threat to the national security, by the DOJ NSD. (AGG-Dom, ’ 

(U) Sensitive monitoring circumstances include: 

L ^)J n y esti | a ^» of a member of Congress, a federal judge, a member of the 

capacTwwhhktf Z ^ ^ * boV * ° r a ' P erson who has «ved in such 
WSS&fi”” yearS (EXeCUtiVe Level 1 throu g h IV are defined in 5 

2 ‘ ( 2}ZT^f 0n ofthe p ovemor > Lieutenant Governor, or Attorney General of any 
• em ° r ^? r a or J" ust ice of the highest court of any state or territory 

r 

3 ' Unitt| P S ‘°M 6 c . 0 '"™ un i cation . is ” ^ custody of the Bureau of Prisons or the 

” 15 bei " g “ h3S b “ n P rotec ‘‘on in the 

4 ' Ge„™lt tt0mey ?■ the Deputy A “°™y General, or an Assistant Attorney 

monitoiim i Kq T th “ the FBI - ° btaln pri0r approval for ‘he use of consensual 

momtonng in a specific investigation. (AGG-Dom, Part VILA and O) 

(U//FOUO) Note: See classified appendix for additional information. 

STa kw »flr° r th r S “ e i l0Cal “ d “ bal 2 ovemmen ‘ s that do not sanction or 
p ovide a law enforcement exception available to the FBI for one-party consensual recording 

communication 5 with persons within their jurisdiction, the SAC must approve the § 

SASorS'te OI°A f ' “ mmUnications as a " OIA, as discussed in Section 17. Prior to the 
AC authorizing the OIA, one-party consent must be acquired. The SAC may delegate this 
OIA approval authority to an ASAC or SSA. ^ may delegate this 

M ' < U | te-of Closed-ciroi.il televis ion direction finders and other monitor;,,,, jaac es subieet 

usS ‘™^c5^e FBI OGC. (The methods described in this p^h 
ustuilly do not require a court order or warrant unless they involve an intrusion into an area 

icattas toT b 8 expec “ tion P-acy or non-consensual mo„i“f ” 

Mra “ ensure compliance wi,h a11 applicabla 

N - (°) Polygraph examinptinnc rAqq p nffl p nr t Y.A.ij) 

0 crimhSlS^SSZr 15 ’ ^ inv ® stl S ations relating to activities in violation of federal 
minal law that do not concern threats to the national security or foreign intelligence 
dercover operations must be carried out in conformity with The Attowev ’ 

not subject to the preceding sentence because they concern threats to the national security 
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or foreign intelligence undercover operations involving religious or political organizations 
must be reviewed and approved by FBI Headquarters, with participation by the DOJ NSD in 
the review process. (AGG-Dom, Part V.A.7) 

P. (U) Compulsory process as authorized bv law, including grand jury subpoenas and other 
subpoenas. National Security Letters (15 U.S.C. §§ 1681u, 1681v; 18 U.S.C. § 2709; 12 
U.S.C. § 3414[a][5][A]; 50 U.S.C. § 436), and FISA orders for the production of tangible 
things. (50 U.S.C. §§ 1861-63). (AGG-Dom, Part V.A.8) 

Q. (U) Accessing stored wire and electronic communications and transactional records in 
conformity with chapter 121 of title 1 8, United States Code (1 8 U.S.C. §§ 2701-2712). 
(AGG-Dom, PartV.A.9) 

R. (U) Use of pen registers and trap and trace devices in conformity with chapter 206 of title 1 8, 
United States Code (18 U.S.C. §§ 3121-3127) or FISA (50 U.S.C. §§ 1841-1846). (AGG- 
Dom, Part V.A.10) 

(U) The following investigative methods can only be used in full investigations: 

S. (U) Electronic surveillance in conformity with chapter 1 19 of Title 18. United States Code 
(18 U.S.C. §§ 25 10-2522), FISA, or Executive Order 12333 § 2.5. (AGG-Dom, Part V.A.1 1) 

T. (U) Physical searches, including mail openings, in conformity with Rule 41 of the Federal 
Rules of Criminal Procedure, FISA, or Executive Order 12333 § 2.5. The classified appendix 
to the DIOG, Appendix G. provides additional information regarding certain searches. 
(AGG-Dom, Part V.A.12) 

U. (U1 Acquisition of foreign intelligence information in conformity with Title Vll of FISA . 
(AGG-Dom, Part V.A.1 3) 

7.10. (U) Sensitive Investigative Matter / Academic Nexus / Buckley Amendment 

(U//FOUO) The title/case caption of the opening or subsequent EC for a full investigation 
involving a sensitive investigative matter must contain the words “Sensitive Investigative 
Matter.” DIOG Section 10 contains the required approval authority and factors to be considered 
when determining whether to conduct or to approve a predicated investigation involving a 
sensitive investigative matter. The AGG-Dom defines sensitive investigative matter as follows: 

A. (U//FOUO) Sensitive Investigative Matter: An investigative matter involving the activities 
of a domestic public official or political candidate (involving corruption or a threat to the 
national security), religious or political organization or individual prominent in such an 
organization, or news media, or any other matter which, in the judgment of the official 
authorizing an investigation, should be brought to the attention of FBI Headquarters and 
other DOJ officials. (AGG-Dom, Part VII.N). As a matter of FBI policy, “judgment” means 
that the decision of the authorizing official is discretionary. DIOG Section 1 0 and/or the 
DIOG classified Appendix G define! I 


B. (U//FOUO) Academic Nexus:f 
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(U//FOUO) The sensitivity related to an academic institution arises from the American 
tradition of “academic freedom” (e.g., an atmosphere in which students and faculty are free 1>2 
to express unorthodox ideas and views and to challenge conventional thought without fear of 
repercussion). Academic freedom does not mean, however, that academic institutions are off 
limits to FBI investigators in pursuit of information or individuals of legitimate investigative 
interest. 


(U//FOUO) For ma tters not considered a sensitive investigative matter] | 

I 1 see the DIOG classified ‘Appendix G . 

C. (U//FOUO) Buckley Amendment: Although not a sensitive investigative matter, a request 
for “academic records” must only be made pursuant to the provisions of the Buckley 
Amendment (The Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232[g], 
as amended by Public Law 107-56 [“USA PATRIOT Act”]). An FBI employee is prohibited 
from receiving “academic records” that have not been properly requested pursuant to the 
Buckley Amendment. The definition of “academic records” is very broad and covers almost 
all records about a student other than public, student directory-type information published by 
the institution. The Buckley Amendment contains a penalty provision f or those institutions 
that improperly provide academic records to law enforcement agencies ! I I 


(U//FOUO) A Buckley Amendment request for academic records cannot be made during an 
assessment. In a predicated investigation, a request for academic records must be made 
pursuant to the Buckley Amendment. 

7.11. (U) Program Specific Investigative Requirements 

(U//FOUO) Because of the many investigative programs within the FBI, a single universal 
requirement will not adequately address every program. To facilitate compliance within an 
existing program, the FBI employee should consult the relevant program policy guidance . 


b2 

i>7E 


93 

UNCLASSIFIED-FOR OFFICIAL USE ONLY 




UNCLASSIFIED - FOR OFFICIAL USE ONLY 
Domestic Investigations and Operations Guide 

8. (U) Enterprise Investigations 

8.1. (U) Overview 

(U) Enterprise investigations may only be opened and operated as full investigations and are 
subject to the same requirements that apply to full investigations described in Section 7 . 

Enterprise investigations focus on groups or organizations that may be involved in the most 
serious criminal or national security threats to the public, as described in Section 8.5 below. 
Enterprise investigations cannot be conducted as preliminary investigations or assessments, nor 
may they be conducted for the sole purpose of collecting positive foreign intelligence. See 
Section 8.2, below, regarding preliminary investigations and assessments. 

8.2. (U) Purpose, Scope and Definitions 

(U) The term “enterprise” includes any partnership, corporation, association, or other legal entity, 
and any union or group of individuals associated in fact, although not a legal entity. The purpose 
of an enterprise investigation is to examine the structure, scope, and nature of the group or 
organization including: its relationship, if any, to a foreign power; the identity and relationship of 
its members, employees, or other persons who may be acting in furtherance of its objectives; its 
finances and resources; its geographical dimensions; its past and future activities and goals; and 
its capacity for harm. (AGG-Dom, Part II.C.2) 

(U//FOUO) Although an enterprise investigation may not be conducted as a preliminary 
investigation, a preliminary investigation may be used to determine whether a group or 
organization is a criminal or terrorist enterprise if the FBI has “information or an allegation” that 
an activity constituting a federal crime or a threat to the national security has or may have 
occurred, is or may be occurring, or will or may occur, arid the investigation may obtain 
information relating to the activity of the group or organization in such activity. An assessment 
may also be initiated to determine whether a group or organization is involved in activities 
constituting violations of federal criminal law or threats to the national security. 

8.3. (U) Civil Liberties and Privacy 

(U) The pursuit of legitimate investigative goals without infringing upon the exercise of 
constitutional freedoms is a challenge that the FBI meets through the application of sound 
judgment and discretion. In order to further ensure that civil liberties are not undermined by the 
conduct of criminal and national security investigations, every full investigation, including an 
enterprise investigation under this subsection, must have an identified authorized purpose and 
adequate predication. 

(U) No investigative activity, including enterprise investigations, may be taken solely on the 
basis of activities that are protected by the First Amendment or on the race, ethnicity, national 
origin or religion of the subject. Enterprise investigations of groups and organizations must focus 
on activities related to the threats or crimes being investigated, not solely on First Amendment 
activities or on the race, ethnicity, national origin or religion of the members of the group or 
organization. In this context, it is particularly important clearly to identify and document the law 
enforcement or national security basis of the enterprise investigation. 

(U//FOUO) Example: Groups who communicate with each other or with 
members of the public in any form in pursuit of social or political causes — 
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such as opposing war or foreign policy, protesting government actions, 
promoting certain religious beliefs, championing particular local, national, or 
international causes, or a change in government through non-criminal means, 
and actively recruit others to join their causes — have a fundamental 
constitutional right to do so. An enterprise investigation may not be initiated 
based solely on the exercise of these First Amendment rights. 

(U) The AGG-Dom authorize all lawful investigative methods in the conduct of an enterprise 
investigation. Considering the effect on the privacy and civil liberties of individuals and the 
potential to damage the reputation of individuals, some of these investigative methods are more 
intrusive than others. The least intrusive method feasible is to be used, but the FBI must not 
hesitate to use any lawful method consistent with the AGG-Dom. A more intrusive method may 
be warranted in light of the seriousness of a criminal or national security threat. 

(U) By emphasizing the use of the least intrusive means to obtain intelligence and/or evidence, 
FBI employees can effectively execute their duties while mitigating the potential negative impact 
on the privacy and civil liberties of all people encompassed within the investigation, including 
targets, witnesses, and victims. This principle is not intended to discourage FBI employees from 
seeking relevant and necessary intelligence, information, or evidence, but rather is intended to 
encourage FBI employees to choose the least intrusive — but still effective means — from the 
available options to obtain the material. 

8.4. (U) Legal Authority 

(U) A full investigation of a group or organization may be initiated as an enterprise investigation 
if there is an articulable factual basis for the investigation that reasonably indicates the group or 
organization may have engaged, or may be engaged in, or may have or may be engaged in 
planning or preparation or provision of support for: (AGG-Dom, Part II.C.l) 

A. (U) A pattern of racketeering activity as defined in 18 U.S.C. § 1961 f5): 

0-0 I nternational terrorism , as defined in the AGG-Dom, Part VII. J, or other threat to the 
national security; 

- 00 Domestic terrorism as defined in 1 8 U.S.C. § 233 I fSI involving a violation of federal 

criminal law; 

D. (U) Furthering political or social goals wholly or in part through activities that involve force 
or violence and a violation of federal criminal law; or 

E. (U) An offense described in 18 U.S.C. § 2332b(g)(5)(B) or 18 U.S.C. § 43. 

8.5. (U) Predication 

00 An enterprise investigation is predicated when there is an articulable factual basis for the 
investigation that reasonably indicates the group or organization may have engaged or may be 
engaged in, or may have or may be engaged in, planning or preparation or provision of support 
for the matters identified in Section 8.4, above. 

(U) The articulable factual basis” for opening an enterprise investigation is met with the 
identification of a group whose statements made in furtherance of its objectives, or its conduct, 
demonstrate a purpose of committing crimes or securing the commission of crimes by others. 

The group’s activities and statements of its members may be considered in combination to 
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comprise the “articulable factual basis,” even if the statements alone or activities alone would not 
warrant such a determination. 


(U//FOUO) Examples of situations in which an enterprise investigation may 
be opened; 



8.6. (U) Duration, Approval, Notice, Documentation and File Review 
A. (U) Initiation: 

1 . (U//FOUO) By a Field Office: The initiation of an enterprise investigation by an FBI 

Field Office requires the prior approval of the Field Office SSA with written notification 
to the appropriate FBIHQ substantive Unit and DOJ (as discussed in greater detail below). 
FBIHQ Divisions may require specific facts to be included in this notification.! ~l b2 

[ b7E 

bnterprise investigations involving sensitive investigative matters require CDC review, 

SAC approval, and written notification to the appropriate FBIHQ substantive Unit and 
DOJ. 

(U//FOUO) The responsible FBIHQ entity must notify the DOJ NSD or the Organized 
Crime and Racketeering Section (OCRS) of the initiation of an enterprise investigation, 
by a Field Office or by FBIHQ, as soon as practicable but no later than 30 days after the 
initiation of the investigation. The FBI Field Office must also notify any relevant USAO, 
except in counterintelligence investigations. See the DOJ NSD policy that governs 
notification to the USAO for counterintelligence investigations. 

2. (U//FOUO) By FBIHQ: The initiation of an enterprise investigation by an FBIHQ 
Division requires the prior approval of the appropriate Section Chief with written 
notification to the appropriate Field Offices and DOJ (as discussed in greater detail 
below). Enterprise investigations involving sensitive investigative matters require OGC 
review, appropriate Assistant Director approval, and written notification to DOJ. 

(U//FOUO) The responsible FBIHQ entity must provide notification of an enterprise 
investigation initiation to the appropriate DOJ component (NSD or OCRS) as soon as 
practicable, but no later than 30 days after the initiation of the investigation. FBIHQ must 
notify any relevant USAO of the initiation of all enterprise investigations, except in 
counterintelligence investigations. 
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(U//FOUO) Note: For enterprise investigations that involve allegations that pertain to 
national security matters, the responsible DOJ component for the purpose of notification 
and reports is the NSD. For enterprise investigations relating to a pattern of racketeering 
activity that does not involve terrorism offenses, see 18 U.S.C. § 2332b(g)(5)(B), the 
responsible DOJ component is the Organized Crime and Racketeering Section.of the 
Criminal Division. (AGG-Dom, Part II.C.3) 

(U) The Assistant Attorney General for National Security or the Chief of the Organized 
Crime and Racketeering Section, as appropriate, may at any time request the FBI to provide a 
report on the status of an enterprise investigation and the FBI will provide such reports as 
requested. (AGG-Dom, Part II C.3.d) 

B. (U//FOUO) Closing: When closing the enterprise investigation, the Field Office or FBIHQ 
will provide the reason for closing the investigation. When closing an enterprise investigation, 
the SSA or Unit Chief must ensure that all pending investigative methods have been 
completed/terminated (e.g., mail covers and pen register/trap and trace). Although there is no 
duration requirement for an enterprise investigation, the investigation must be closed upon all 
investigative activity being exhausted. 

1 . (U//FOUO) Closing an enterprise investigation initiated bv a Field Office remiirpg 
approval from the SSA f I 


2. (U//FOUO) Closin g an enterprise investigation initiated by FBIHQ requires approval 

from the Unit Chief ) [ 

3. (U//FOUO) Closing an enterprise investigation initiated by a F ield Office involving a b7E 

sensitive investigative matter requires approval from the SAC, f 


4. (U//FOUO) Closing an enterprise investigation initiated by FBIHQ inv olving a 
sensitive investigative matter requires appr oval from the Section Chief,! 


C. (U//FOUO) File Review: 

(U//FOUO) Supervisory file reviews must be conducted at least once every 90 days in 
accordance with Section 3.4. File reviews for probationary agents must be conducted at least 
once every 60 days. 
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9 . (U) Foreign Intelligence 


9.1. (U) Overview 

(U) Foreign intelligence is “information relating to the capabilities, intentions, or activities of 
foreign governments or elements thereof, foreign organizations, or foreign persons, or 
international terrorists.” A “Foreign Intelligence Requirement” is a collection requirement issued 
under the authority of the DNI and accepted by the FBI DI. Additionally, the President, a USIC 
office designated by the President, the Attorney General, Deputy Attorney General, or other 
designated DOJ official may levy a Foreign Intelligence Requirement on the FBI.. Foreign 
intelligence collection by the FBI is based upon requirements. 

(U//FOUO) Foreign Intelligence Requirements issued by one of the parties listed above and 
accepted by the FBI DI will fall into one of two categories: (i) those that address national 
security issues that are within the FBI’s core national security mission; and (ii) information 
relating to the capabilities, intentions, or activities of foreign governments or elements thereof, 
foreign organizations, foreign persons, or international terrorists which are not within the FBI’s 
core national security mission. 

(U//FOUO) Requirements which fall into the first category may correspond to FBI National 
Collection Requirements as defined in Section 5.11. FBI National Collection Requirements will 
only be addressed in properly authorized assessments or incidental to predicated investigations 
(See the DI PG for specific requirements.) 

(U//FOUO) Requirements which fall into the second category are known as Positive Foreign 
Intelligence Requirements and may only be addressed under the authorities described in this 
section. Assessments and full investigations intended to result in the collection of positive 
foreign intelligence must be based upon established requirements and approved by FBIHQ DI. 

!lZe?r' Stigati ° nS f ° r the SQle purp 0se of colle ^ tin g positive foreign intelligence are not b2 
’ | b7E 

7 - — - — ,, [Assessments and full investigations initiatpH 

purpose of positive foreign intelligence collection must be opened by FBIHQ CMS. For 

assessments, the authorized purpose and identified objective must be documented in the 
assessment file. 


(U//FOUO) The general guidance of the FBI’s foreign intelligence collection activities by DNI- 
authorized requirements does not limit the FBI’s authority to conduct investigations supportable 
on the basis of its other authorities— to investigate federal crimes and threats to the national 
security— in areas in which the information sought also falls under the definition of foreign 
intelligence/’ (AGG-Dom, Introduction A.3) Accordingly, the AGG-Dom authorizes the 
collection of foreign intelligence incidental to predicated criminal, counterintelligence 
counterterrorism, cyber, and weapons of mass destruction investigations. 


(U//FOUO) FBI National Collection Requirements which address national security issues that 
are within the FBI's core national security mission will be worked under FBI substantive case 
classifications (e.g., 200, 105, 315) as assessments. An assessment cannot be opened solely 
based upon an FBI National Collection Requirement. An authorized purpose (national security or 
criminal threat) must exist and the objective of the assessment must be clearly articulated when 
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opening an authorized assessment. The authorized purpose and identified objective for all 
assessments must be documented in the assessment file. 

(U//FOUO) Example: 



(U//FOUO) Note: FBIHQ DI provides specific guidance in its policy implementation guide 
regarding FBI National Collection Requirements, FBI Field Office Collection Requirements, 
and Positive Foreign Intelligence Requirements. 

9.2. (U) Purpose and Scope 

(U//FOUO) As stated above, foreign intelligence is “information relating to the capabilities, 
intentions, or activities of foreign governments or elements thereof, foreign organizations, or 
foreign persons, or international terrorists.” The collection of positive foreign intelligence 
extends the sphere of the FBI’s information-gathering activities beyond federal crimes and 
threats to the national security and permits the FBI to seek information regarding a broader range 
of matters relating to foreign powers, organizations, or persons that may be of interest to the 
conduct of the United States’ foreign affairs. (AGG-Dom, Introduction A.3) 

9.3. (U) Civil Liberties and Privacy 

(U) Because the authority to collect positive foreign intelligence enables the FBI to obtain 
information pertinent to the United States’ conduct of its foreign affairs, even if that information 
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is not related to criminal activity or threats to the national security, the information so gathered 
UJnS “fiS”- Accordi "Sly, the FBI must operate openly and consensual^ with 

(AQG-Dom Steion '^* mm **‘ P-M™ foreign intelligence. 

constimtlonal'f “^tiniate investigative goals without infringing upon the exercise of 
' J d0ms ls a challenge that the FBI meets through the application of sound 

assessment^ J H '° ““ enSUre that “Ml liberties are not undermined, every 

or toil investigation involving the collection of positive foreign intelligence under 
this section must have an authorized purpose and an identified objective. Additionally the 

^ ~ ~ ■» documented andretained 

tekln sdX l g th V h aCtiVi r ty ’ ! nCludin ! the colIection of Positive foreign intelligence, may be- 

fthnS LT , S ^ S ° f ^ ? VltieS ^ 3re protected ^ the First Amendment or on the race, 
ethnicity, national origin or religion of the subject. Collection of positive foreign intelligence 

EFirSr relating to a matter of foreign intelligence interest responsive to a 
poswv v : ££ Sgr S33Z2 or (,i) a ft " investiga,ion is »“ - ■ 

(U) The AGG-Dom present investigators with a number of authorized investigative methods in 

or fu " investigation ,o con ” *»* 
darnel H ffeC °" the pnV3Cy and ClviI liberties of individuals and the potential to 

than others 6 Th iT° mdlvlduals > some of these investigative methods are more intrusive 
n others. The least intrusive method feasible is to be used, but the FBI must not hesitate to use 

2^ekTtoS Stent Whh ^ AGG ' DOm - ^ BXplanati0n ° f ^ ^ 

Sat^toa' 'ma^of ^ ^^gence either as part of an assessment 

Positive ^ Fordgn Inllf ‘ ntelhgenCe lnt ® rest or as P art °f a &U investigation predicated on a 
Uni ed cw intelligence Requirement, the FBI must operate openly and consensually with a 
United States person, to the extent practicable. y 

ind ^ y : mp b asizing tbe use °f the •east intrusive means to collect positive foreign intelligence 

t0 l° Perate ° PC S! y 3nd COnsensuaI1 y with a United States person, to 
P !’ FBI em P lQ y ees can effectively execute their duties while mitigating the 

L coHectio^^rhi ' mPaCt - T PriV3Cy CiYil liberti6S ° f 311 peopie encountered as part of 
the collection. This principle is not intended to discourage FBI employees from seeking relevant 

emnLv 6883 ? P0Slt ‘ Ve l f ° reign intelii 8ence or evidence, but rather h intended to make fure FBI 

z!S™r east ,n ‘ rasiva - but sun «» op*”-™ 1 

9.4. (U) Legal Authority 

(U) The FBI’s legal authority to collect positive foreign intelligence derives from a mixture of 

§§™0Uts« “g us C^S ST",' E '°' ' 2333 ' 50 U ' S - C ' 85 401 M *** 50 U - S ' C - 

I; * A q '\r T 8 U - S,C - § 532 note [incorporates the Intelligence Reform and Terrorism 

will bVguided bvCollec'f 58 R^ 200l ' 2003 P- In collectin g positive foreign intelligence, the FBI 
guided by Collection Requirements issued under the authority of the DNI, including the 
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National Intelligence Priorities Framework and the National HUMINT Collection Directives, or 
any successor directives issues under the authority of the DNI and accepted by FBIHQ DI. 

A. (U) Assessment Activities 

(U//FOUO) As discussed in Section 5 of the DIOG, the AGG-Dom authorize six types of 
assessments, one of which specifically applies to collection of positive foreign intelligence as 
follows: “seeking information, proactively or in response to investigative leads on matters of 
foreign intelligence interest responsive to foreign intelligence requirements.” Positive Foreign 
Intelligence Requirements can be found on the DI’s Collection Management Section website . 
Further instructions on the collection of positive foreign intelligence are contained in the Dl PG . 

B. (U) Full Investigation Activities 

(U//FOUO) As discussed in Se ction 7 of the DIOG, the AGG-Dom cites three predication 
circumstances warranting a full investigation, one of which specifically applies to collection of 
positive foreign intelligence: “The full investigation may obtain foreign intelligence that is 
responsive to a foreign intelligence requirement.” 

(U//TOUO) Predicated positive foreign intelligence collection originates when the Office of the 
DNI levies a foreign intelligence collection requirement on the FBI and the DI accepts the 

requirement as one to which the FBI will endeavor to respond to as part of its Positive Foreign 
Intelligence Program. 

(U//F0U 0 ) A full investigation to collect positive foreign intelligence is appropriate only when a 

, T? ' a “ t | 1 ®" z I e(l requirement exists for a particular issue and that requirement has been accepted 
by rBIHQ DI. 

9.5. (U//FOUO) Duration, Approval, Notice, Documentation, File Review and FBIHQ 
Standards for Approving the Initiation of Positive Foreign Intelligence 
Investigations 

A. (U//FOUO) Positive Foreign Intelligence Collection Authorities. 

(U//FOUO) The FBIHQ CMS is responsible for promulgating FBI policy and oversight of 
nnf InteI1,genc : e CoIlection Program (FICP). FBIHQ CMS will provide notice to the 
UJ NSD upon the initiation of a positive foreign intelligence investigation. To ensure that 
all positive foreign intelligence collection is focused on authorized Positive Foreign 
Intelligence Requirements, only FBIHQ CMS may approve the initiation of a positive 
foreign intelligenc e assessment or full investigation! ~lnr ,c 

determined by DI).| | 

I. , | Field offices must request, by EC, FBIHQ CMS approval 

to open such assessments and full investigations. 

B. (U//FOUO) Standards to be Considered When Initiating an Assessment or Full Foreign 
Intelligence Investigation to Collect Positive Foreign Intelligence 

(U//FOUO) Before initiating or approving an assessment or full investigation for the purpose 
of collecting positive foreign intelligence, the approving official must determine whether: 

1 . (U//FOUO) An authorized purpose and objective exists for the conduct of the assessment 
or an authorized purpose and adequate predication exists for initiating a full investigation; 
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2. (U//FOUO) The assessment or full investigation is not based solely on the exercise of 
First Amendment activities or on the race, ethnicity, national origin or religion of the 
subject; and 

3. (U//FOUO) The assessment or full investigation is an appropriate use of personnel and 
financial resources. 

9.6. (U//FOUO) Standards for Initiating or Approving the Use of an Authorized 
Investigative Method 

(U//FOUO) Before initiating or approving the use of an investigative method in an assessment or 
full investigation for the purpose of collecting positive foreign intelligence, an FBI employee or 
approving official must determine whether: 

A. (U//FOUO) The use of the particular investigative method is likely to further the purpose of 
the assessment or full investigation; 

B. (U//FOUO) The investigative method selected is the least intrusive method, reasonable under 
the circumstances and, if taken relative to a United States person, the method involves open 
and consensual activities, to the extent practicable; 

C. (U//FOUO) If open and consensual activity would likely be successful, then covert non- 
consensual contact with a United States person may not be approved. 

D. (U//FOUO) In the case of an assessment, the anticipated value of the assessment justifies the 
use of the selected investigative method or methods; and 

E. (U//FOUO) The investigative method is an appropriate use of personnel and financial 
resources. 

9.7. (U) Authorized Investigative Methods in Foreign Intelligence Assessments and 
Predicated Investigations 

(U//FOUO) Prior to initiating or approving the use of a method, an FBI employee and approving 
official will apply the standards as provided in Section 9.6. With the exceptions noted below, all 
lawful assessment methods may be used during positive foreign intelligence assessments. With 
the exceptions noted below, all lawful methods may be used during a full investigation to collect 
positive foreign intelligence. If actions are to be taken with respect to a United States person, 
the method used must include open and consensual activities, to the extent practicable. 

A. (U) Assessments (see DIOG Section 5.9 for a complete description of the following methods 
that may be used in assessments): 

1 • (U) Obtain publicly available information . 

2- 0-0 Engage in observation or surveillance not requiring a court order . 

2- (U) Access and examine FBI and other DOJ records, and obtain information from anv 
FBI or other DOJ personnel . 

4- (U) Access and examine reco rds maintained by. and request information from, other 
f ederal, state, local, or t ribal, or foreign governmental entities or agencies . 

(U) Use online servi ces and resources (whether non-profit or commercial). 

6 ■ (U) Interview or request information from members of the public and private entities . 
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7 ' (U) Accept informal ion , v olunta ril y provided by governmental or private entities . 

Use and recruit hum an sources in conformity with the AGCLCHS 

(U//FOUO) Note; The use of Federal Grand Jury Subpoenas, to include subpoenas for 
telephone or electronic mail subscriber information, is not authorized in a positive foreign 
intelligence assessment. 

B. (U) Full Investigations: 


(U) In addition t0 the authorized methods listed in Section 9.7.A, above, the following lawful 
foreign ^ntdHgence 6 ^ ^ 5nVeStigations °P ened for the purpose of collecting positive 


L ( u ) ph ysical searches of person al or re al property where a warrant or court order is not 
le gally required because there is no reas onable expectation of nrivarv (c a trash 
covers). (AGG-Dom, Part V.A.3) ' V 8 

2 ' ^ C onsensual monitor ing of communications, including consensual computer 
m onitoring, subject to lega l review by the CPC or the FBI OGC Where a sensitive 
monitoring circumstance is involved, the monitoring must be approved by the DOJ 

° r ’ if the investigation concerns a threat to the national security, by 
the DOJ NSD. (AGG-Dom, Part V.A.4) 

(U//FOUO) Note: See the classified appendix for additional information. 

(U//FOUQ)| 1“ 1 


4. 


3 ' (U j Use of closed-circuit telev isio n , direction finders, and other monitoring devices. 
subj ect to legal review by the CPC o r . the FBI OGC . (The methods described in this 
paragraph usually do not require court orders or warrants unless they involve an 
intrusion into an area where there is a reasonable expectation of privacy or non- 
consensual monitoring of communications, but legal review is necessary to ensure 
compliance with all applicable legal requirements.) (AGG-Dom, Part V.A.5) 

(U) Polygraph examinations (AGG-Dom, Part V.A.6) 

5 - Un dercover operations . Undercover operations involving religious or political 
organizations conducted for the purpose of collecting positive foreign intelligence must 

oror s e 7! d rr d n aPP T e , d with P artici P ation b y the DOJ NSD in the review 

process. (AGG-Dom, Part V.A.7) 

6 ?nTl^^^ l^ P .T,.^' SterS and trap and tr ace d evices in conformity with FISA 
V A 10) 84M846) ’ for non - United States persons only. (AGG-Dom, Part 


? ' surveil| ance in con formi t y with FISA or E.O. 12333 § 9 5 rArta.n^ 
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8. (U//FOUQ) P hysical searches, inc luding mail openings, in conformity with FISA nr 

— '? 333 § 2 - 5 - The classified appendix to the DIOG provides additional information ' 
regarding certain searches. (AGG-Dom, Part V.A.12) 

9 ’ ^ ^ cqu'shion of positive foreign intelligence information in conformity with Title 
Vllof FISA . (AGG-Dom, Part V. A. 13) 

10. (U//FOUO) Obtaining a business rec ords order pursuant to FISA. 50 U.S.C. §5 1861-83 
for records relating to a non-United States person only. 

9 ‘ 8 ' (U/ f n ^ s ^ a I t I |^ S s tigatiVe Methods Not Authorized During Foreign Intelligence 

me,hods are " ot permi,ted for,he purpose of 1 


B 


D. 

E. 

F. 


A - U S - C - 1681 “- '«* 18 § 2709; ,2 

(U//FOUO) Obtaining a busine ss rec ords order pursuant to FISA. 50 U.S.C 66 1861-1863 

for records relating to a United States person; 

^^'fersand trap and . trace devices in conformity with FISA (50 
U.S.C. §§ 1841-1846) on a United States person; 

Isusclp ^f 3 i 27 e ^ ~ tCrS and trap - and trace devices in conformity with chapter 206 of 
(U//FOUO) Mail covers : 

CO T UlS0 7, PrOCeSS 35 authorized b y la w, including grand iurv subp oenas and 
other subpoenas (e.g.. Administrative Subpoena); and 

G. [ U "FQ UQ ) Accegsiiptor ed wire and el ec tronic communications' and transactional records 
(AG^D^^IrtVA^)^ 121 ° ftltie 18 ’ United States Code (18 U.S.C. §§ 2701-2712). 

9.9. (U) Sensitive Investigative Matter 

(^°U°) The titIe/case ca P tion of the opening or subsequent EC for a positive foreign 
,nvolv T ing a sensitive investigative matter must contain the words 
stlinT ' ! vr f rn SltlVe InVeStlgative Matter ” The title/case caption of the opening or 
r,PnT EC ^ a fU inVeStlgatl0n for the colIect ion of positive foreign intelligence involving 
a sensitive investigative matter must contain the words “Sensitive Investigative Matter ” DIOG § 

a “ and faCt ° rS t0 be COnsted ^ve to an 
assessment or a predicated investigation involving a sensitive investigative matter. The AGG- 
Dom defines sensitive investigative matter as follows: 

A ' Sn U0 ! Sen ur Ve 5 Ve f igatiVe Matter: An inves % a tive matter involving the activities 
nationTJ !™ bhc ° fficial or P olltlcal candidate (involving corruption or a threat to the 
r al eCUnty) ’ re ‘ gIOaS or P° lltlcal organization or individual prominent in such an 
Zfhn lTJ 1 ’ °- nC Z S I3 ’ °, r any ° ther matter which ’ in *e judgment of the official 

Other noTnfr "mS. 3h ° uld bebrou § ht to the attention of FBI Headquarters and 
other DOJ officials. (AGG-Dom, Part VII.N.) As a matter of FBI policy, “judgment” means 
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that the decision of the authorizing official is discretionary. DIOG Section 1 0 and/or the 
DIOG classified Appen dix G define] 


All positive foreign intelligence assessments or full investigations involving a sensitive 
investigative matter must be reviewed by the CDC, approved by the SAC, and approved by 
the appropriate FBIHQ DI Section Chief, (see DIOG Section 9.10 below) 

B. (U//FOUQ 1 ) Academic Nevns-I — — — — — — — ^ — 


(U//FOIJO) The sensitivity related to an academic institution arises from the American 
tradition of academic freedom” (e.g., an atmosphere in which students and faculty are free 

ZZZTaT id T Vi r and t0 ChaIlen ^ e COnventional thought wtoul fear Of 
S— i ): Aca f demic freedora does not mean » however, that academic institutions are off 
inTerest ^ mV * g ° rS m P ursuit of information or individuals of legitimate investigative 


(U//FOUQ)p 


3 


jsee the DIOG classified Appendix G . 


9.10. (U) Approval and Notification 
A. (U) Initiation 

(U//FOUO) The authorized purpose of an assessment or full investigation must be 
documented in the initiating EC. 

1 ' 1 U 5» 0U0) A PP rovaI to Initiate an Assessment to Collect Positive Foreign 

Of no J enC f : N ° asses ® raent for the purpose of seeking information relating to matters 
positive foreign intelligence interest responsive to a Positive Foreign Intelligence 

£ ren TnS J* ““hated wi thout prior approval from FBTHO CMS Aft.r 
obtaining FBIHQ CMS annroval 1 


H i“ e uue/case caption of the opening EC must contain the 

P eunonrin . i • . 


l ■ . *« k « 1 . 1 ~ vw r viv/i ‘ upciimy dl/ must contain 

w a ;As t , and the synopsis must identify the authorized purpose and the 

objective of the assessment. 

2 ‘ SS' of fid? r ° ya \ t0 3 ? UU Investigation: FBIH Q CMS will direct the 

initiation of full investigations based on Positive Foreign Intelligence Requirements. 

3 ’ Ap P. rov f I t0 Initiate an Assessment or Full Investigation Involving a 

ensitive Investigative Matter: The initiation of either an assessment or full 

“““‘fnf 6 f ° reign intelligence involving a sensitive jnyestigatiye 

Sn ChlXZal reV ‘ eW ’ SAC aPPr ° Val and ' he aPPr ° Pria,e FBWQ M 


b2 

b7E 


b2 

b7E 


b2 

b7E 
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B. (U) Notice 

1 . (U//FOUO) Notification to DOJ is not required when an assessment to collect 
information relating to a matter of foreign intelligence interest responsive to a positive 
foreign intelligence requirement is initiated. 

2. (U//FOUO) Notification to DOJ is required when a full investigation to collect 
information responsive to a foreign intelligence requirement is initiated. Notice must be 
forwarded from FBIHQ CMS to the DOJ.NSD as soon as practicable but no later than 
30 calendar days after the initiation of the investigation. (AGG-Dom, Part 1I.B.5) 

C. (U) Duration 

(U//FOUO) A foreign intelligence assessment and full investigation may continue for as long 
as necessary to achieve its purpose and objective if an assessment, or until the requirement is 
met in a full investigation. 

D. (U) File Review 

1. (U//FOUO) Assessments: Foreign intelligence assessments require recurring 90 day file 
reviews of the assessment file and any sub-file by the SSA/S1A. File reviews for 
probationary agents must be conducted at least every 60-days. The file review must: 

a. (U//FOUO) Evaluate the progress made toward the achievement of the authorized 
purpose and objective; 

b. (U//FOUO) Determine whether it is reasonably likely that information may be 
obtained that is relevant to the authorized objective, thereby warranting a continuation 
of the assessment; 

C Determine whether the Field Office has appropriate access and ability to 

collect positive foreign intelligence in response to a requirement that has been 
accepted by FBIHQ DI; and 

d. (U//FOUO) Determine whether the assessment should be terminated. 

2. (U//FOUO) Full Investigations:. Supervisory file reviews must be conducted at least 
every 90 days in accordance with Section 3.4. File reviews for probationary agents must 
be conducted at least every 60-days. 

E. (U) Closing 

(U//FOUO) Upon its determination or at the request of the Field Office, only FBIHQ CMS 
may close an assessment or full investigation. 

F. (U) Annual Letterhead Memorandum 

1 . (U//FOUO) Field Office Responsibility: All FIGs must submit an annual report on 
each positive foreign intelligence full investigation that was open for any period of time 
during the past calendar year. This report is due to FBIHQ CMS no later than January 
30th of the calendar year following each year during which a full investigation is open 
and must consist of the following: 

a. (U//FOUO) The Positive Foreign Intelligence Requirement to which the 
investigation was responding; 
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b. (U//FOUO) All methods of collection used; 

c. (U//FOUO) All sensitive matters encountered; 

d. (U//FOUO) A list of all IIRs by number issued based on information collected 
during the investigation; 

e. (U//FOUO) A summary of the positive foreign intelligence collected; and 

f. (U//FOUO) The date the full investigation was opened and, if applicable, the date 


2 . 


(U//FOUO) These reports should be submitted by electronic communication. The EC 
must be uploaded into ACS in a file number and in the applicable Foreign Intelligence 
Collection Program (FICP) case files as designated in the DI PG. 

(U//FOUO) FBIHQ Responsibility: FBIHQ CMS must compile data from each Field 
Office regarding the scope and nature of the prior year’s positive foreign intelligence 
collection program. The FBIHQ CMS must submit an annual comprehensive report of 
all activity described above to DOJ NSD no later than April 1 st of each year. The repon 
must include the following information: " 


a. (U//FOUO) The Positive Foreign Intelligence Requirement to which the 
investigation was responding; 

b. (U//FOUO) All sensitive matters; and 

c. (U//FOUO) The date the full investigation was opened and closed (if applicable). 

9.11. (U) Retention of Information 


Ed of S r 7 T a dat3baSe ° r reCOrds s y stems that P^mits the prompt 

closed! thl dl f 8 of 1 ^P^ive foreign intelligence collection full investigation (open or 
closed), the dates of opening and closing, and the basis for the full investigation 
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